high Known exploited

CVE-2026-64849

MLflow Server-Side Request Forgery Vulnerability

MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.

Published: Aug 17, 2026
CVSS: 9.3
Vendor: MLflow
Product: MLflow
CISA due date: 2026-09-02
Source: merged

References

ADVISORY

Check your website: Korisec scans for exposed services, weak TLS, missing headers, and WordPress plugin risks. Run a free scan or start a trial.

← Back to CVE Tracker · Official record: cve.org