MSRXMSRXSecurity
Vendors / MLflow

MLflow vulnerabilities being exploited

1 MLflow flaw was confirmed exploited in the wild in the past 365 days, across 1 product: MLflow. If you run any of them, patch these first.

AddedExploited vulnerabilityFix by
2026-08-19CVE-2026-64849 MLflow
MLflow Server-Side Request Forgery Vulnerability

MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.

2026-09-02
Watch my MLflow softwareScan a websiteAll vendors

Source: CISA Known Exploited Vulnerabilities catalog 2026.10.29 (live). A listing means some versions are affected: check yours in the advisory. Guidance only.