CVE-2026-64849
Server-Side Request Forgery in MLflow. CISA confirmed attackers exploit it and added it to its Known Exploited Vulnerabilities catalog on 19 August 2026.
- Product
- MLflow
- Added to CISA's catalog
- Federal fix-by date
- Ransomware
- No known use in ransomware campaigns
- Sources
- CISA’s catalog, NVD entry
CISA’s description.
MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.
Every flaw CISA confirmed exploited in the last 30 days is on the exploit watch. This is not security advice. Check the vendor’s advisory before acting. From CISA’s catalog of 4 November 2026.