ZDI-26-846: MLflow Webhook Server-Side Request Forgery Vulnerability

CVE v události 1

Hodnocení z katalogů, všechna, se stupnicí CVSS a vydavatelem. Rozpad vektoru je na stránce CVE. Advisory v textu uvádí CVSS 6.8.

Jak se o tom psalo 5

1. 29. 10. 2026 · zachyceno 21:00 · Zero Day Initiative US nadpis události

   ZDI-26-846: MLflow Webhook Server-Side Request Forgery Vulnerability

   This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of MLflow. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.8. The following CVEs are assigned: CVE-2026-64849.

2. 20. 8. 2026 13:06 · BleepingComputer US

   CISA warns of hackers exploiting critical MLflow vulnerability

   The Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies that threat actors are now exploiting a critical vulnerability in the MLflow open-source AI engineering platform. [...]

3. 19. 8. 2026 20:28 · Cyber Centre Kanada CA

   MLflow security advisory (AV26-832)

   Serial Number: AV26-832Date: August 19, 2026 As of August 17, 2026, MLflow is affected by vulnerabilities in the following product: MLflow Prior to 3.15.0 On August 19, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-64849 to their Known Exploited Vulnerabilities (KEV) Database. The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Release v3.15.0 · mlflow/mlflow · GitHub…

4. 19. 8. 2026 · zachyceno 20:30 · CISA Advisories US

   CISA Adds One Known Exploited Vulnerability to Catalog

   CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-64849 MLflow Server-Side Request Forgery Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian…

5. 19. 8. 2026 · zachyceno 20:00 · CISA KEV US

   MLflow Server-Side Request Forgery Vulnerability (CVE-2026-64849)

   CISA added CVE-2026-64849 to the Known Exploited Vulnerabilities catalog. Affected product: MLflow MLflow. Remediation due date: 2026-09-02.