MLflow webhook bug now under active attack, CISA confirms
A validation gap in MLflow's webhook testing feature can be abused to sneak past security checks and reach internal systems — and someone is already doing it.
A flaw in MLflow, the widely used open-source platform for managing machine learning experiments, has been added to America’s official list of vulnerabilities that criminals are actively exploiting — not just theoretically dangerous, but confirmed in use.
The CISA Known Exploited Vulnerabilities catalogue added CVE-2026-64849 on 19 August 2026, giving US federal agencies until 2 September to patch. That short window is CISA’s standard signal that exploitation is real and ongoing, rather than a precaution against something merely possible.
What the bug actually does
According to the NVD listing, the problem sits in MLflow’s webhook-testing feature — an endpoint that lets a server check whether a webhook URL is reachable before it’s used for real. MLflow validates that starting URL to stop it pointing somewhere sensitive, such as an internal network address or a cloud provider’s metadata service (the kind of internal-only address that can hand over cloud credentials to anything that asks).
The catch is that the validation only checks the original URL. If that URL then redirects somewhere else, MLflow’s delivery code follows the redirect and resolves the new address without re-checking it. In effect, the front door is locked but the back door — reached via a simple redirect — is left wide open. An attacker can use this to make the MLflow server fetch data from internal systems or cloud metadata endpoints and read back the response.
Crucially, no login is required. The vulnerable endpoint is unauthenticated, and GitHub’s assessment (the body that assigned the CVE) rates it 9.3 out of 10 — critical.
So who is actually at risk
This is an enterprise and infrastructure issue, not a consumer one. MLflow is a backend tool used by data science and engineering teams to track and manage machine learning models; it isn’t installed on ordinary PCs or phones, and there’s no reason for a typical NerdBite reader to have it running at home.
The people who should care are organisations running their own MLflow servers — particularly if those servers sit inside cloud environments where metadata services hold credentials, or on internal networks not meant to be reachable from outside. The fix was shipped in MLflow 3.15.0, according to NVD, meaning a patch exists and has done for some time before this KEV listing; the concern now is who hasn’t applied it.
CISA’s KEV entry lists ransomware association as “unknown” — so there’s no confirmed link to ransomware crews yet, though that could change as more is learned about how it’s being used.
What to do about it
If you or your organisation run MLflow, the advice is unambiguous: upgrade to version 3.15.0 or later without delay. Federal US agencies have a hard deadline, but the same urgency applies to anyone running an internet-facing or cloud-hosted MLflow instance, given that exploitation is already confirmed rather than hypothetical.
For everyone else, this is a case to note rather than worry about. It’s a sharp reminder that “we checked the URL” security controls can be undone by something as mundane as a redirect — a pattern worth remembering next time a vendor claims a system is validated and safe. But unless you’re the one running the server, there’s nothing here that reaches your laptop, your phone, or your evening.