MLflow security advisory (AV26-832)

[MalBot]

Introduction to Malware Binary Triage (IMBT) Course

Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.

Enroll Now and Save 10%: Coupon Code MWNEWS10

Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.

  <div>
<div>

        <div><p><strong>Serial Number: </strong>AV26-832<br /><strong>Date: </strong>August 19, 2026</p>

As of August 17, 2026, MLflow is affected by vulnerabilities in the following product:

• MLflow
  • Prior to 3.15.0

On August 19, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-64849 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Release v3.15.0 · mlflow/mlflow · GitHub
• Unauthenticated full-read SSRF in MLflow webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding) · Advisory · mlflow/mlflow · GitHub
• CISA KEV: CVE-2026-64849

</div>

Article Link: MLflow security advisory (AV26-832) - Canadian Centre for Cyber Security