CRITICALCVSS 9.3Actively exploited · CISA KEV since 2026-08-19Vulnerability
CVE-2026-64849
MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.
Properties
- Vulnerability name
- MLflow Server-Side Request Forgery Vulnerability
- Epss score
- 0.09839
- Last seen
- 2026-10-19T12:00:27+00:00
- Due date
- 2026-09-02
- Exploited euvd since
- 2026-08-19T00:00:00+00:00
- Date added
- 2026-08-19
- Source url
- https://epss.empiricalsecurity.com/epss_scores-2026-10-19.csv.gz
- Ghsa updated
- 2026-08-17T21:58:52Z
- Euvd base score version
- 3.1
- Score
- 9.3
- Euvd vendor
- mlflow
- In Signal since
- initial import (Sep 2026)
- Euvd base score
- 9.3
- Is ghsa only
- false
- Vendor project
- MLflow
- Content hash
- 64e176571a832caa87b0467396ff4725fe8d4861de44de6f535b38a0df5abe64
- Published at
- 2026-08-17T22:17:23.580
- Euvd updated
- 2026-10-02T18:22:19+00:00
- Last modified
- 2026-10-05T13:35:35.850
- Euvd epss pct
- 9.84
Related Entities (6)
AFFECTS (1)
AFFECTS_PRODUCT (1)
DESCRIBES (1)
HAS_WEAKNESS (1)
INVOLVES (1)
VULNERABLE_TO (1)
Explore deeper with Ninja Signal's threat intelligence graph