CVE-2026-64849

MLflow's server-side request forgery flaw lets attackers access internal cloud metadata services.

MLflow contains a server-side request forgery vulnerability that allows attackers to reach internal or cloud metadata services and retrieve response_status and response_body. This exposes sensitive infrastructure details and can lead to further compromise of cloud environments. DIB organizations should ensure MLflow is patched and restrict metadata service access.

Shame score — A server-side request forgery flaw in an actively exploited (KEV) vulnerability that exposes internal cloud metadata services is a significant, avoidable security failure.