HIGHVulnerability
Verified
Global

CISA KEV: MLflow MLflow — MLflow Server-Side Request Forgery Vulnerability

·Source: CISA KEV

Updated:

Executive Summary

MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.

Analysis

MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body. Added to CISA Known Exploited Vulnerabilities catalog on 2026-08-19. Remediation due: 2026-09-02.

Indicators of Compromise (1)

CVE (1)
CVE-2026-64849
NVDMITRE CVE
Source Attribution

Originally published by CISA KEV on Aug 19, 2026. Verified by: CISA.

Related Threats

MEDIUMVulnerability

ShinyHunters hacker reportedly detained in Jordan, aiding FBI

A suspected ShinyHunters hacking group member known online as "Rey" has reportedly been detained in Jordan and is cooperating with the FBI to help locate other members of the extortion group. [...]

BleepingComputer
MEDIUMVulnerability

YARA-X 1.21.0 Release, (Sat, Oct 3rd)

YARA-X&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s 1.21.0 release brings 5 improvements and 4 bugfixes.

SANS ISC
MEDIUMVulnerability

Danish university DTU breach exposes data of up to 200,000 people

The Technical University of Denmark (DTU) says information belonging to up to 200,000 users may have been exposed after hackers accessed its identity and access management system and downloaded a large amount of data. [...]

BleepingComputer