CVE-2026-64849-PoC

CVE-2026-64849-PoC 要获取此 PoC - 加入 https://t.me/thecodeb0ss...

Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets

Two critical vulnerabilities impacting MLflow, an open-source artificial intelligence AI platform, and FUXA, an open-source, web-based SCADA / HMI software built for operational technology OT and industrial automation, are witnessing malicious scanning and exploitation efforts. According to...

CVE-2026-64849 MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/id/test endpoint calls validatewebhookurl in mlflow/utils/validation.py only for the original URL while...