CVE-2026-64849: MLflow MLflow

MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.

Vendor: MLflow
Product: MLflow
Vulnerability: MLflow Server-Side Request Forgery Vulnerability
Date added: Aug 19, 2026
CISA due date (U.S. federal agencies): Sep 2, 2026
Known ransomware campaign use: Unknown
Weakness (CWE): CWE-918

References

NVD — CVE-2026-64849
github.com
github.com
www.cisa.gov
www.cisa.gov
nvd.nist.gov

This site summarizes CISA's catalog for information only. It is not security advice — follow your vendor's guidance and official advisories.

Last updated: Oct 4, 2026 17:31 UTC · Catalog version 2026.10.02