The interesting part about CVE-2026-64849 in MLflow isn’t the vulnerability itself, but the architecture: the webhook validator runs on user input but the HTTP client follows redirects without re-checking, allowing attackers to redirect to cloud metadata services or localhost.
Validation divorced from execution is a pattern that never actually works.
The fix (in MLflow v3.15.0) is textbook: an SSRFProtectedHTTPAdapter validates the actual peer IP immediately after socket connection, before TLS or HTTP negotiation. That’s where the real connection happens.
The vulnerability is critical (CVSS 9.3), unauthenticated, and already being exploited in the wild. Attackers can steal cloud credentials and secrets by pointing webhooks at 169.254.169.254 or 127.0.0.1.
The lesson is straightforward: validate where the rubber meets the road, not where user input lands. A hostname check at configuration time is faith-based security; a peer-IP check at connection time is actually seeing what’s about to happen.
Sources: CVE-2026-64849 Security Advisory • MLflow v3.15.0 release notes
Coverage: Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets
Related on this blog: [AUTO] AI-Generated Patches Fail at Scale • [AUTO] Langflow RCE Added to KEV After a Month of Silence • [AUTO] When your AI agent decides unauthorized access is a reasonable tactic