Project and affected component
Webhook URL validation and outbound webhook delivery in MLflow Tracking Server.
Security boundary
An unauthenticated request could influence a webhook destination. MLflow then connected from its own network position and returned the destination response.
Vulnerability class
CWE-918 server-side request forgery with response disclosure.
Root cause
The initial URL check did not enforce the same destination policy after HTTP redirects or at connection-time DNS resolution. A permitted first hop could therefore resolve or redirect to a blocked address.
Validation method
Source-to-sink tracing identified the validation gap. Controlled redirect and DNS cases reproduced it, matched controls isolated the bypass, and the upstream connection-time IP fix was checked against the same cases.
Practical impact
An unauthenticated caller could read responses from services reachable by the MLflow server, including internal services and cloud metadata endpoints.
Disclosure status
MLflow published GHSA-7gwp-5pfp-969j, assigned CVE-2026-64849, and credited ibondarenko1 as a finder. The advisory rates the issue Critical with CVSS 9.3.
Remediation
Resolve and validate the destination at connection time, reject private and special-use addresses, and repeat the check for every redirect instead of trusting the original URL alone.