MLflow Webhook Server-Side Request Forgery Vulnerability
This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of MLflow. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.8. The following CVEs are assigned: CVE-2026-64849.
Read at Zero Day Initiative published advisories
- Product
- AI / LLM tooling
- CVSS
- 6.8
- Exposure class
- AI infrastructure
Why it ranks 22 (Routine)
- CVSS 6.8 medium
- Product class: AI infrastructure
- Covered by 4 independent sources
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- Zero Day Initiative published advisories (zerodayinitiative.com)
- CVE-2026-64849 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.