CVE-2026-64849: Critical Server-Side Request Forgery (SSRF) in MLflow Webhook Notifications

HERMES

HERMES THREAT SCORE & MLOPS CLOUD INFRASTRUCTURE EXPOSURE

Target: MLflow (Machine Learning Lifecycle Platform)

Confidence: 99%

94 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 20 / 20

Threat Activity 18 / 20

Weaponization 19 / 20

Exposure 19 / 20

Prevalence 19 / 20

Impact 19 / 20

Exploit Maturity 20 / 20

Attack Chain Potential 20 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-64849 at 9.3 (Critical) and CVSS v4.0 scores 9.3. The Hermes Threat Score assigns 94 (CRITICAL). Alignment is direct: MLflow servers frequently execute within high-privilege Kubernetes namespaces or cloud virtual machines with IAM access to S3/GCS model buckets and training datasets. Exploiting SSRF delivers instance metadata tokens, granting full cloud tenant administration.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-64849: Critical Server-Side Request Forgery (SSRF) in MLflow Webhook NotificationsVULNERABILITY

Connected Nodes: 2

Active Relationships (Outgoing)

→ affectsPRODUCTCPython Interpreter & Standard Library

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in CPython Interpreter & Standard Library documented in Hermes dossier.”

Supporting Verified Evidence:

[vulnerability_report]
[government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

→ usesATTACK TECHNIQUET1552: Unsecured Credentials

90% VERY_HIGH

Adversaries search compromise victims for unsecured credentials in files, environment variables, or memory.

🔍 Why is this related? (Evidence & Provenance)

“Attack execution telemetry aligns with MITRE ATT&CK technique T1552.”

Supporting Verified Evidence:

[government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

CVE-2026-64849 is a critical Server-Side Request Forgery (SSRF) vulnerability impacting MLflow, the leading open-source platform for managing the machine learning lifecycle. The flaw exists within the Model Registry and experiment webhook notification dispatcher (/ajax-api/2.0/mlflow/webhooks/create).

Due to an absence of IP validation, loopback filtering, and URL scheme restriction on registered webhook endpoints, remote adversaries can register webhooks targeting cloud instance metadata services (http://169.254.169.254/latest/meta-data/ on AWS, http://metadata.google.internal/ on GCP) or internal container orchestration APIs. When MLflow fires test notifications or event triggers, the server makes requests directly from its internal network identity and reflects metadata responses back into run artifacts, resulting in cloud identity theft and cloud infrastructure compromise.

1. Technical Context & Affected Software Matrix

MLflow manages machine learning experiments, code packaging, model registry versions, and production deployment integrations.

Parameter	Technical Specification	Threat Context
CVE Identifier	`CVE-2026-64849`	International Vulnerability Tracking ID
Vulnerable Component	`mlflow.server.handlers` (Webhook Dispatcher)	Model registry event notification engine
Network Vector	HTTP/HTTPS (Default Port `5000/TCP`)	Public or VPC internal tracking servers
Root Cause	Unrestricted URL destination in HTTP client (CWE-918)	SSRF targeting cloud metadata APIs
Affected Versions	MLflow `< 3.15.0`	Cloud and on-premises MLflow tracking servers
Fixed Versions	`3.15.0`	Official release enforcing IP deny-lists
Exploitation Impact	Cloud IAM credentials theft, internal Kubernetes pivot	Full cloud tenant compromise

2. In-Depth Technical Decomposition: Webhook SSRF Mechanics

A. The Unvalidated Webhook Registration

MLflow allows users to register webhooks to notify external platforms (Slack, PagerDuty, CI/CD runners) when model transitions occur:

# Vulnerable handler in mlflow/server/handlers.py
def _create_webhook(request_data):
    url = request_data.get("url")
    # VULNERABILITY: No check for loopback, RFC 1918, or cloud metadata IP addresses
    webhook = WebhookModel(url=url, events=request_data.get("events"))
    return webhook_store.save(webhook)

def _dispatch_webhook_notification(webhook, payload):
    # Direct outbound request from MLflow server context
    response = requests.post(webhook.url, json=payload, timeout=5)
    return response.text

+----------------------------------------------------------------------------------------------------+
|                         CVE-2026-64849 ATTACK SEQUENCE DIAGRAM                                      |
+----------------------------------------------------------------------------------------------------+

   [Remote Adversary]
          │
          │ [1] HTTP POST /ajax-api/2.0/mlflow/webhooks/create
          │     Payload: { "url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/",
          │                "events": ["MODEL_VERSION_CREATED"] }
          ▼
   [MLflow Tracking Server (Port 5000 / AWS EC2 or EKS)]
          │
          ├───► 1. Webhook Registration:
          │     - Accepts target URL without DNS validation or private IP filtering
          │
          │ [2] Adversary triggers: POST /ajax-api/2.0/mlflow/model-versions/create
          ▼
   [MLflow Webhook Dispatch Engine]
          │
          ├───► 3. Internal SSRF Query:
          │     - Issues HTTP GET/POST to http://169.254.169.254/latest/meta-data/
          │     - AWS IMDS service answers query from instance context
          │     - MLflow captures IAM temporary access tokens:
          │       AccessKeyId, SecretAccessKey, Token
          │
          ▼
   [Credential Exfiltration via Event Response / Error Log]
          │
          └───► Attacker reads reflected token from test notification logs:
                - Configures AWS CLI with stolen IAM Role credentials
                - Accesses S3 buckets containing training sets and model weights
                - Escalates privileges across entire AWS account
+----------------------------------------------------------------------------------------------------+

3. Threat Intelligence & Exploitation in the Wild

Targeting ML Infrastructure: Automated reconnaissance tools specifically probe MLflow tracking servers on port 5000 to identify instances hosted on cloud platforms.
IMDSv1 Vulnerability: Deployments where AWS IMDSv2 (session token requirement) is not enforced are particularly vulnerable, allowing single-request extraction of IAM role credentials.
Internal Kubernetes Pivoting: When deployed within Kubernetes, attackers target https://kubernetes.default.svc using the pod’s service account token located in /var/run/secrets/kubernetes.io/serviceaccount/token.

4. MITRE ATT&CK Mapping

Tactic	Technique ID	Technique Name	Exploitation Manifestation
Initial Access	`T1190`	Exploit Public-Facing Application	Remote HTTP POST registering malicious webhook
Credential Access	`T1552.005`	Cloud Instance Metadata API	Querying 169.254.169.254 to dump IAM credentials
Discovery	`T1046`	Network Service Discovery	Port scanning internal cluster services via SSRF
Lateral Movement	`T1021`	Remote Services	Utilizing cloud IAM tokens to access AWS/GCP infrastructure

5. Detection Engineering & Telemetry

A. Suricata Detection Rule

alert http any any -> $MLFLOW_SERVERS 5000 (
  msg:"HERMES DEFENSE - MLflow Webhook Metadata SSRF Attempt (CVE-2026-64849)";
  flow:established,to_server;
  http.method; content:"POST";
  http.uri; content:"/webhooks/create";
  http.request_body; pcre:"/(\"url\"\s*:\s*\"https?:\/\/(169\.254\.169\.254|metadata\.google\.internal|127\.0\.0\.1|localhost))/i";
  classtype:web-application-attack;
  sid:202664849;
  rev:1;
  reference:cve,2026-64849;
)

B. Sigma Detection Rule

title: MLflow Process Connecting to Cloud Metadata IP
id: 8c7b6a5d-4e3f-2a1b-0c9d-64849c026e01
status: high
description: Detects outbound network connections initiated by the MLflow server process towards cloud instance metadata endpoints.
author: Hermes Codex Detection Engineering
date: 2026-09-11
logsource:
  product: linux
  category: network_connection
detection:
  selection_process:
    Image|contains: 'python'
    CommandLine|contains: 'mlflow'
  selection_destination:
    DestinationIp:
      - '169.254.169.254'
      - '127.0.0.1'
  condition: selection_process and selection_destination
falsepositives:
  - Legitimate initial cloud provider SDK authentication handshakes (should use IMDSv2).
level: critical
tags:
  - attack.initial_access
  - attack.t1190
  - attack.credential_access
  - attack.t1552.005

6. Digital Forensics & Incident Response (DFIR)

Forensics Triage Checklist:

Query MLflow Webhook Database:

SELECT id, url, events, created_time FROM webhooks;
-- Identify any URLs containing 169.254, internal IP ranges, or localhost

Review CloudTrail / GCP Audit Logs:
- Filter for GetRole or AssumeRole calls originating from the MLflow instance IP at the time of the event.
Inspect Outbound Network Flows:
- Check VPC Flow Logs for connections from the MLflow host to 169.254.169.254:80.

Hunting Query (Elasticsearch / OpenSearch):

{
  "query": {
    "bool": {
      "must": [
        { "term": { "url.path": "/ajax-api/2.0/mlflow/webhooks/create" } },
        { "wildcard": { "http.request.body.content": "*169.254.169.254*" } }
      ]
    }
  }
}

7. Mitigation & Remediation

Upgrade MLflow: Upgrade the mlflow server to version 3.15.0 or later.

Enforce AWS IMDSv2: Require tokens for instance metadata queries and set the hop limit to 1 to block container-based SSRF queries:

aws ec2 modify-instance-metadata-options \
  --instance-id i-0123456789abcdef0 \
  --http-tokens required \
  --http-put-response-hop-limit 1

Network Egress Filtering: Deploy Kubernetes NetworkPolicies or firewall egress rules blocking MLflow worker pods from connecting to 169.254.169.254/32.
Credential Rotation: Immediately rotate any AWS IAM role keys or service account tokens associated with the MLflow instance.