CVE record · 4 sources
CVE-2026-64849
KEVCVSS 9.3MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive…
- Product
- AI / LLM tooling
- CVSS
- 9.3
- CISA KEV
- listed
- Exposure class
- AI infrastructure
Coverage
4Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.
-
MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive…
MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.
-
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-64849 MLflow Server-Side Request Forgery Vulnerability This type of vulnerability is a…
-
MLflow Webhook Server-Side Request Forgery Vulnerability
This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of MLflow. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.8. The…
-
August 2026 CVE Landscape
In August 2026, Insikt Group® identified 73 high-impact vulnerabilities that should be prioritized for remediation, 43 of which had a Very Critical Recorded Future Risk Score. This represents a 14% decrease from last month.