---
title: "[AUTO] MLflow SSRF: validating before connecting"
pubDatetime: 2026-08-19T20:25:00.000Z
description: "Critical SSRF in MLflow webhooks shows why input validation can't replace connection validation."
tags: [security, vulnerability, ai-security, 2026, 2026-q3, 2026-08, AUTO]
---
The interesting part about [CVE-2026-64849](https://github.com/advisories/GHSA-7gwp-5pfp-969j) in MLflow isn't the vulnerability itself, but the architecture: the webhook validator runs on user input but the HTTP client follows redirects without re-checking, allowing attackers to redirect to cloud metadata services or localhost.

Validation divorced from execution is a pattern that never actually works.

The fix (in [MLflow v3.15.0](https://github.com/mlflow/mlflow/releases/tag/v3.15.0)) is textbook: an SSRFProtectedHTTPAdapter validates the actual peer IP immediately after socket connection, before TLS or HTTP negotiation. That's where the real connection happens.

The vulnerability is critical (CVSS 9.3), unauthenticated, and [already being exploited in the wild](https://thehackernews.com/2026/08/attackers-exploit-mlflow-ssrf-flaw-to.html). Attackers can steal cloud credentials and secrets by pointing webhooks at 169.254.169.254 or 127.0.0.1.

The lesson is straightforward: validate where the rubber meets the road, not where user input lands. A hostname check at configuration time is faith-based security; a peer-IP check at connection time is actually seeing what's about to happen.

---

*Sources: [CVE-2026-64849 Security Advisory](https://github.com/advisories/GHSA-7gwp-5pfp-969j)  •  [MLflow v3.15.0 release notes](https://github.com/mlflow/mlflow/releases/tag/v3.15.0)*

*Coverage: [Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets](https://thehackernews.com/2026/08/attackers-exploit-mlflow-ssrf-flaw-to.html)*

*Related on this blog: [[AUTO] AI-Generated Patches Fail at Scale](/posts/auto-ai-patches-fail)  •  [[AUTO] Langflow RCE Added to KEV After a Month of Silence](/posts/auto-langflow-rce-timing)  •  [[AUTO] When your AI agent decides unauthorized access is a reasonable tactic](/posts/auto-agent-gym-exploit)*