Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
CVE-2026-64849 affects MLflow through 3.13.0. On a default Tracking Server, webhook management and the synchronous test endpoint are unauthenticated. An attacker registers a public HTTPS webhook, triggers its test, and returns a 302 redirect to a loopback, private-network, or cloud-metadata URL. MLflow validates only the original hostname; it follows the redirect without validating or pinning the destination and reflects the internal response body back to the caller. The advisory demonstrates a local secret service and identifies cloud instance metadata and internal admin services as reachable targets.
CISA added the CVE to the Known Exploited Vulnerabilities catalog on 2026-08-19 without publishing exploitation details. The advisory lists a code fix — PR #24258, which validates each connected peer including redirect targets — but GitHub lists no patched version, so no minimum safe release exists.
ASSESSED SYSTEM
A default open-source MLflow Tracking Server through version 3.13.0, in its pre-fix state, reachable from an untrusted network: the optional auth plugin is not loaded, so webhook management and the synchronous /api/2.0/mlflow/webhooks/{id}/test endpoint accept unauthenticated calls; _validate_webhook_url() resolves and rejects non-public addresses at registration time but the validated address is not pinned to delivery, and the test endpoint reflects the upstream status and body. Representative configuration: any MLflow Tracking Server on an affected version whose webhook APIs are reachable by an untrusted caller.
OUT OF SCOPE
The attacker-controlled HTTPS endpoint that issues the 302 is not the assessed system. Deployments that load an authentication plugin or place the server behind a restrictive gateway are a different configuration and are not scored here. Cloud instance metadata services and the internal admin services reached through the SSRF are downstream targets, not the assessed boundary. No patched release existed at analysis time, so no post-fix state is assessed. CISA's KEV listing establishes that the CVE is exploited but publishes no exploitation details, so no victim, payload, or credential-theft outcome is scored.
Architecture: Traditional ML / Classifier (decision tree Q6) — The decision tree resolves at Q6 by elimination. Q1 = NO (no coordinating agents). Q2 = NO (the server responds to API calls; it holds no task goal, plan, or multi-step workflow of its own). Q3 = NO (no model calls a function; the tracking server itself performs the outbound fetch). Q4 = NO (no inference-time retrieval layer). Q5 = NO (no generative interface is involved in the disclosed path). What remains is ML lifecycle platform infrastructure — experiment tracking and model-registry services for conventional ML workloads — which the classifier weight class represents. Tier 3: Tier 3 (Internal): an MLflow Tracking Server is ML platform infrastructure inside the organisational boundary, serving controlled service clients and ML engineers rather than public users, which is the same treatment given to the ChromaDB vector-database case. The advisory's remediation is framed as enabling an authentication layer and placing the server behind a restrictive gateway — internal-service guidance. The fact that the disclosed path is reachable unauthenticated is carried by the ORP Attack Surface dimension (As = 1.00), not by raising the tier.
Documented attack or failure path
- An unauthenticated caller registers a webhook whose URL points at an attacker-controlled public HTTPS endpoint; _validate_webhook_url() resolves that hostname, finds it public, and accepts it.
- The caller invokes the unauthenticated synchronous test endpoint /api/2.0/mlflow/webhooks/{id}/test.
- The attacker endpoint answers with a 302 redirect to a loopback, private-network, or cloud-metadata URL. MLflow follows the redirect without re-validating or pinning the destination, so the address that was checked is not the address that is connected to.
- The test API returns the upstream status and body to the unauthenticated caller, converting the redirect into a full-read SSRF primitive against local secret services, cloud instance metadata, and internal admin services.
Observed controls and bounded outcomes
Positive credit is given only where the record directly demonstrates a control operating. Recommended or merely presumed controls receive no positive scoring credit.
- A URL validation step existed and ran on registration: _validate_webhook_url() resolved the supplied hostname and rejected non-public addresses, so the direct case — registering a loopback or private-range URL outright — was refused. Cn-1 is scored at 0.25 rather than 0.00 on this basis.
- The advisory characterises the defect as a validation-to-use gap in redirect handling rather than as an absence of URL policy, so the registration-time policy itself is not scored as a failure.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 3 MVT 0.40 indeterminate | |||
| Fairness (Fa) NOT APPLICABLE — axis-level applicability rule (Person-Outcome Surface test): The assessed system is an MLflow Tracking Server (model registry and experiment tracking) whose outputs are webhook deliveries and tracking API responses to operators; it allocates, ranks or describes no natural person and no protected-class attribute or proxy is present in its inputs. Its tier weight is redistributed across the remaining axes and its MVT is not evaluated. | |||
| Transparency (Tr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 3 MVT 0.45 indeterminate | |||
| Privacy (Pr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 3 MVT 0.50 indeterminate | |||
| Containment (Cn) — scenario interval 0.06–0.68 (midpoint 0.36), Tier 3 MVT 0.50 indeterminate | |||
| Cn-1Scope Enforcement | 0.25w 0.22 | 0.25 anchor: a scope boundary exists but is inconsistently enforced — it governs registration and not the connection that matters, so the same request can leave the authorised destination set between check and use. The 0.50 anchor requires enforcement bound to the resource actually accessed, which the advisory states is absent. | A boundary exists and is enforced at one point only. The advisory states that _validate_webhook_url() resolved and rejected non-public addresses, but that the validated address was not pinned to delivery, so each redirect or later connection could resolve to a different destination. AID-H-019.001 is recommended precisely to make the fetcher validate every redirect target and connect only to the freshly validated public IP, which indicates that the deployed fetcher does neither.source: brief |
| Cn-3Output Filtering Robustness | 0.00w 0.08 | 0.00 anchor: no output filtering or release policy is evidenced on this path; internal content is returned directly to an untrusted caller, which is the literal 0.00 criterion. The 0.25 anchor requires a basic filter, and none exists between the upstream response and the API reply. | The synchronous test endpoint returns the upstream status and body to the caller. There is no release gate between an internal response — a local secret service, cloud instance metadata, or an internal admin service — and an unauthenticated requester. The advisory identifies this reflection as what turns the redirect into a readable SSRF primitive rather than a blind one.source: brief |
| Cn-5Agent Identity Integrity | 0.00w 0.08 | 0.00 anchor: no identity verification exists on the assessed control surface — the server accepts arbitrary callers. The 0.25 anchor requires at least basic API-key authentication, and the default configuration loads none. | The advisory states that the open-source default server does not load the optional auth plugin, so an unauthenticated caller can create a webhook and invoke the test endpoint. Webhook create, update, delete, and test are control-surface operations executed with no caller identity at all. AID-H-004.002 is recommended to require authenticated, short-lived credentials on the server-side API path rather than relying on network reachability.source: brief |
Unknown, not N/A: 17 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Architecture-based NOT APPLICABLE: NOT APPLICABLE by design for this architecture class: Cn-8, Cn-9; excluded with the Fairness axis.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 0.25w 0.20 | The server executes requests; it plans nothing and holds no task goal. Its only independent action is the outbound webhook delivery it performs on behalf of a caller, which is a configured side effect rather than an autonomous decision. That matches the low end of the scale, above zero only because the outbound fetch is initiated by the service itself. |
| AsAttack Surface Exposure | 1.00w 0.25 | The 1.00 anchor is met literally: on the default configuration the webhook management and test APIs accept unauthenticated requests from any reachable network, and the attacker fully controls both the registered URL and the redirect response. Untrusted input from an open origin reaches the assessed component with no authentication in between. elevated |
| CpCascade Potential | 1.00w 0.30 | No verified System Dependency Graph exists for the assessed configuration, so the specification's worst-case default applies. It is independently corroborated on its merits: the observed path is ungated end to end and terminates at cloud instance metadata and internal admin services, whose credentials reach resources far outside the MLflow workload. The advisory's own guidance — treat returned secrets as exposed and rotate them — reflects that the reachable node set extends beyond the assessed component.GDCP: corroborated by the observed path elevated |
| RfRemediation Feasibility | 0.50w 0.25 | Scored above the deployment-infrastructure anchor because no released fixed artefact exists. The advisory lists a code fix (PR #24258) but GitHub lists no patched version, and it explicitly warns defenders not to invent a minimum safe release. Remediation therefore depends on expiring compensating controls — disabling webhooks, gateway restriction, egress policy — with the finding held open until a vendor release containing the fix is available and its exact artefact verified. |
Nelevated = 2 (dimensions strictly above 0.75) → CRM = 1.15.
Compound Risk Alert. Two or more dimensions are simultaneously elevated (spec 3.2.2); architectural decomposition is recommended before deployment.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.25 | At the 0.25 anchor. The advisory identifies the product, the affected version range, the exact endpoints, the validation function, the default authorisation state, and the proposed code fix. It does not identify a deployment owner, a service inventory, an identity policy, or any evaluation artefact for a specific installation, and no AIBOM or equivalent record exists for the assessed configuration. |
| Ec — Public evaluation coverage | 0.14 | coverage 0.15 (3 of 20 applicable sub-metrics) × independence 1.00 × fidelity 0.95. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.65 | Evidence dated 2026-08-02; age 77 days on the workpaper reference date. Components: C_monitor 0.65 · C_event 0.65 · T_calendar 0.75 · C_evidence 0.85. Binding term: C_monitor. C_monitor 0.65 — no detection of the redirect chain is evidenced, and the advisory has to ask defenders to start reviewing webhook URLs, redirect telemetry, and test responses for attacker-controlled public hosts followed by private or link-local destinations. C_event 0.65 — the moderate row applies: the KEV listing establishes exploitation of the CVE, but no critical-invariant violation is confirmed in any specific assessed deployment, so the major row is not supported. C_evidence 0.85 — the finding is unresolved by construction: no patched release exists and the advisory directs defenders to keep it open behind expiring compensating controls. BAW does not apply: the assessed component holds no mutable behavioural state, memory, or multi-session accumulation. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.28 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
Published CVSS beside indicative ERS
Each published CVSS record is shown exactly as its scorer published it, one per vulnerability record, with the version, metric group and vector when stated, plus its source and access date. Records are never combined or inferred from a CVE's existence.
INDICATIVE ERS · NORMALIZED-ASSURANCE SCENARIO
5.0 midpoint, interval 1.8–8.2; Moderate scenario band; ACI fixed at 1.00. The published CVSS records do not enter this calculation.
PUBLISHED CVSS · 1 record
CVE-2026-64849 CVSS 3.1 Base 8.6 High
| Published score | 8.6 |
|---|---|
| CVSS version | 3.1 |
| Metric group | Base |
| Severity | High |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
| Scored by | MLflow / GitHub maintainer advisory |
| Source record | https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j (accessed 2026-10-18) |
| Affected component | mlflow |
| Scope note | Maintainer advisory score covers the 302 read and credential exposure path assessed here; the CVE-wide CNA 9.3 includes a 307/308 write variant outside this case. |
CVSS describes an individual vulnerability as its scorer published it. Indicative ERS describes the assessed AI deployment under the normalized-assurance scenario, so the two values are not direct equivalents and neither replaces the other.
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-H-019.001 | URL Normalization & Allowlist FilteringAIDEFEND dataVersion 2026.10.15. A fail-closed safe fetcher that validates every redirect target, connects only to the freshly validated public IP, and binds the decision to the final URL and returned bytes is the Cn-1 control whose absence produces the validation-to-use gap; it closes both the redirect and DNS-rebinding TOCTOU paths. | Very High | Cn-1 Cn-3 Cn-8 |
| AID-H-004.002 | Service & API AuthenticationAIDEFEND dataVersion 2026.10.15. Authenticated, short-lived credentials for webhook creation and test operations, enforced on the server-side API path rather than through network reachability, is the Cn-5 control the default configuration does not load. | High | Tr-3 Cn-5 |
| AID-I-002.001 | Internal AI Network SegmentationAIDEFEND dataVersion 2026.10.15. Least-privilege internal network policy so the MLflow workload cannot reach instance metadata, loopback-admin bridges, or unrelated private services is the compensating boundary that would bound Cp even when application URL validation fails. | High | Cn-4 |
| AID-H-003.010 | Deployed AI Software Vulnerability Remediation LifecycleAIDEFEND dataVersion 2026.10.15. Tracking every instance through 3.13.0 as vulnerable and deploying a vendor release containing PR #24258 only after its exact artefact is available and verified is the Rf remediation route; it is not IVP evidence for this case. | High | Ro-4 Ro-5 Tr-4 |
WHAT THIS CASE TEACHES
Cn-1 scores 0.25 rather than 0.00 even though the SSRF succeeded completely, because AITBM scores the boundary that exists rather than the outcome that occurred: MLflow did have a destination policy and it did reject direct private-range URLs. What it lacked was binding that decision to the connection actually made — the distinction between a check and an enforcement point, which is exactly the gap between the 0.25 and 0.50 anchors.
Sources: AIDEFEND in Action — MLflow Webhook Redirects Turn a Public URL into Full-Read SSRF · Primary source — Unauthenticated full-read SSRF in MLflow webhook delivery (GHSA-7gwp-5pfp-969j), 2026-08-02 · AIDEFEND SecureFlow — MLflow Unauthenticated Webhook Redirect to Full-Read SSRF
AIDEFEND SecureFlow attack-flow cross-reference
The same incident is modelled step by step, with ATLAS technique labels and AIDEFEND defense mappings, in AIDEFEND SecureFlow. The flow is listed for navigation only; this record's evidence and scores come from the sources cited above. Open SecureFlow.
- MLflow Unauthenticated Webhook Redirect to Full-Read SSRF (same incident · AIDEFEND curated research flow)ATLAS techniques: AML.T0049, AML.T0107, AML.T0025