[KEV] CVE-2026-64849: MLflow Server-Side Request Forgery Vulnerability
Active exploitation (KEV)
What to do
- On CISA KEV — actively exploited. Patch immediately.
MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.
CVE · detail
- CVE-2026-64849KEVEPSS 16%NVD ↗