CSIRTS // UNIFIED SECURITY ADVISORY FEEDSYS ● ONLINE · POWERED BY INTELFUSIONS.COM

CSIRTSSecurity advisory fusion

← All products & vendors

MLflow — security advisories

5 advisories5 exploitedlatest 2026-08-19⚡ RSS feed

Tracked MLflow products:

⚡ Watch MLflow

Get an email when a new MLflow advisory drops — max one per day, one-click unsubscribe.

MLflow security advisory (AV26-832)

unknownexploitedCVE-2026-64849cccs2026-08-19

CISA Adds One Known Exploited Vulnerability to Catalog

highexploitedCVE-2026-64849cisa2026-08-19

CVE-2026-64849: MLflow Server-Side Request Forgery Vulnerability

criticalexploitedCVE-2026-64849cisa-kev2026-08-19

CVE-2026-64849: MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/

criticalexploitedCVSS 9.3CVE-2026-64849nvd2026-08-17

GHSA-7gwp-5pfp-969j: MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

criticalexploitedCVSS 9.3CVE-2026-64849ghsa2026-08-17