MLflow Server‑Side Request Forgery (CVE‑2026‑64849) Exposes Internal Metadata Services
What It Is — MLflow’s tracking server fails to validate user‑supplied URLs, enabling a server‑side request forgery (SSRF) that can reach internal or cloud metadata endpoints and return their response.
Exploitability — Publicly disclosed; proof‑of‑concept code is available; CVSS 8.5 (High).
Affected Products — MLflow open‑source platform (all versions prior to the vendor’s patch released 2026‑09‑15).
Why It Matters for Trust & Control Assurance —
- Highlights a missing control around outbound request validation, a key element of network‑segmentation and data‑exfiltration safeguards.
- Provides auditors with a concrete evidence point to verify that logging of external calls is captured and retained.
- Demonstrates the importance of continuous control mapping to show remediation status across frameworks (e.g., NIST CSF, ISO 27001).
Recommended Actions —
- Deploy the vendor‑issued patch or upgrade to the latest MLflow release.
- Enforce an allow‑list of approved URLs and reject any user‑controlled destinations.
- Enable detailed logging of all outbound requests from MLflow and integrate logs into a SIEM for continuous monitoring.
- Review network segmentation to ensure metadata services are isolated from MLflow instances.
Source: CISA KEV – CVE‑2026‑64849