{"schema_version":"2","view":"grouped","data":[{"id":70964,"cve_ids":["CVE-2026-64849"],"payload":{"kind":"advisory","title":"MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)","summary":"### Summary The default MLflow Tracking Server (`mlflow server`, no authentication, default SQLite backend) exposes the model-registry webhooks API unauthenticated, including a synchronous `POST /api/2.0/mlflow/webhooks/{id}/test` endpoint that returns the upstream response status and body to the caller. The SSRF guard added in PR #20747 (`_validate_webhook_url`, shipped in 3.10.0) resolves the webhook hostname and rejects non-public IPs, but it is bypassable: delivery follows HTTP redirects (no `allow_redirects=False`) and never pins the validated IP. An attacker hosts a public HTTPS endpoint that passes the guard and returns `302 Location: http://169.254.169.254/...` (or `http://127.0.0.1:...`); MLflow follows it and never re-validates the redirect target. Because `/test` reflects the response body, this is an unauthenticated full-read SSRF on a default server. ### Details Three facts combine: 1. Webhook endpoints are unauthenticated on a default server. The only webhook authorization lives in the optional auth plugin (`mlflow/server/auth/__init__.py`, `WEBHOOK_BEFORE_REQUEST_HANDLERS`), which is not loaded by default. 2. The guard validates but pins nothing — `mlflow/utils/validation.py` `_validate_webhook_url`: ```python schemes = _MLFLOW_WEBHOOK_ALLOWED_SCHEMES.get() # default [\"https\"] if parsed_url.scheme not in schemes: raise ... if not _MLFLOW_WEBHOOK_ALLOW_PRIVATE_IPS.get(): # default False for addr_info in socket.getaddrinfo(hostname, None): ip = ipaddress.ip_addre","evidence":"osv:GHSA-7gwp-5pfp-969j","products":[{"name":{"value":"mlflow","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.15.0","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"3.10.0","evidence":"/affected/0/versions"},{"value":"3.10.0rc0","evidence":"/affected/0/versions"},{"value":"3.10.1","evidence":"/affected/0/versions"},{"value":"3.11.0","evidence":"/affected/0/versions"},{"value":"3.11.0rc0","evidence":"/affected/0/versions"},{"value":"3.11.0rc1","evidence":"/affected/0/versions"},{"value":"3.11.1","evidence":"/affected/0/versions"},{"value":"3.12.0","evidence":"/affected/0/versions"},{"value":"3.12.0rc0","evidence":"/affected/0/versions"},{"value":"3.13.0","evidence":"/affected/0/versions"},{"value":"3.13.0rc0","evidence":"/affected/0/versions"},{"value":"3.14.0","evidence":"/affected/0/versions"},{"value":"3.3.0","evidence":"/affected/0/versions"},{"value":"3.3.1","evidence":"/affected/0/versions"},{"value":"3.3.2","evidence":"/affected/0/versions"},{"value":"3.4.0","evidence":"/affected/0/versions"},{"value":"3.4.0rc0","evidence":"/affected/0/versions"},{"value":"3.5.0","evidence":"/affected/0/versions"},{"value":"3.5.0rc0","evidence":"/affected/0/versions"},{"value":"3.5.1","evidence":"/affected/0/versions"},{"value":"3.6.0","evidence":"/affected/0/versions"},{"value":"3.6.0rc0","evidence":"/affected/0/versions"},{"value":"3.7.0","evidence":"/affected/0/versions"},{"value":"3.7.0rc0","evidence":"/affected/0/versions"},{"value":"3.8.0","evidence":"/affected/0/versions"},{"value":"3.8.0rc0","evidence":"/affected/0/versions"},{"value":"3.8.1","evidence":"/affected/0/versions"},{"value":"3.9.0","evidence":"/affected/0/versions"},{"value":"3.9.0rc0","evidence":"/affected/0/versions"}]}],"severity":"critical","structured":{"id":"GHSA-7gwp-5pfp-969j","aliases":["BIT-mlflow-2026-64849","CVE-2026-64849","GHSA-7gwp-5pfp-969j","PYSEC-2026-3687"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.15.0"}]}],"package":{"name":"mlflow","purl":"pkg:pypi/mlflow","ecosystem":"PyPI"},"versions":["3.10.0","3.10.0rc0","3.10.1","3.11.0","3.11.0rc0","3.11.0rc1","3.11.1","3.12.0","3.12.0rc0","3.13.0","3.13.0rc0","3.14.0","3.3.0","3.3.1","3.3.2","3.4.0","3.4.0rc0","3.5.0","3.5.0rc0","3.5.1","3.6.0","3.6.0rc0","3.7.0","3.7.0rc0","3.8.0","3.8.0rc0","3.8.1","3.9.0","3.9.0rc0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-7gwp-5pfp-969j/GHSA-7gwp-5pfp-969j.json"}}],"modified":"2026-10-02T18:30:39.856988982Z","provider":"osv","references":["https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j","https://nvd.nist.gov/vuln/detail/CVE-2026-64849","https://github.com/mlflow/mlflow/issues/24179","https://github.com/mlflow/mlflow/pull/24258","https://github.com/mlflow/mlflow/commit/ba949522477cbd5915aa55d29b0cfad7d5ddf939","https://github.com/advisories/GHSA-7gwp-5pfp-969j","https://github.com/mlflow/mlflow","https://github.com/mlflow/mlflow/releases/tag/v3.15.0","https://github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2026-3687.yaml","https://pypi.org/project/mlflow","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-64849"],"provider_metadata":{"cwe_ids":["CWE-918"],"severity":"CRITICAL","github_reviewed":true,"nvd_published_at":"2026-08-17T22:17:23Z","github_reviewed_at":"2026-08-17T21:58:51Z"}},"related_cves":[{"value":"CVE-2026-64849","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"osv:GHSA-7gwp-5pfp-969j","priority":{"reasons":["publisher_severity","linked_severity","known_exploited"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-64849","metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":9.3,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"mlflow","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64849","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-64849","metrics":[],"products":[{"name":{"value":"MLflow","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-64849","relationship":"advisory","known_exploited":true,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":true,"publisher_severity":"critical"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-7gwp-5pfp-969j","advisory_id":"5fe1fa61-7fc5-45f7-b11a-9586f3d40a1f","event_types":["advisory"],"published_at":"2026-10-25T22:45:50.32144+00:00","technologies":["core-osv","mlflow"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-17T21:58:51+00:00","detail_url":"/advisories/osv%3AGHSA-7gwp-5pfp-969j","group":{"id":"osv:GHSA-7gwp-5pfp-969j","revision":1,"primary_event_id":71335,"change":"published","superseded_by":[],"changed":{"id":71335,"cve_ids":["CVE-2026-64849"],"payload":{"kind":"advisory","title":"MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)","summary":"### Summary The default MLflow Tracking Server (`mlflow server`, no authentication, default SQLite backend) exposes the model-registry webhooks API unauthenticated, including a synchronous `POST /api/2.0/mlflow/webhooks/{id}/test` endpoint that returns the upstream response status and body to the caller. The SSRF guard added in PR #20747 (`_validate_webhook_url`, shipped in 3.10.0) resolves the webhook hostname and rejects non-public IPs, but it is bypassable: delivery follows HTTP redirects (no `allow_redirects=False`) and never pins the validated IP. An attacker hosts a public HTTPS endpoint that passes the guard and returns `302 Location: http://169.254.169.254/...` (or `http://127.0.0.1:...`); MLflow follows it and never re-validates the redirect target. Because `/test` reflects the response body, this is an unauthenticated full-read SSRF on a default server. ### Details Three facts combine: 1. Webhook endpoints are unauthenticated on a default server. The only webhook authorization lives in the optional auth plugin (`mlflow/server/auth/__init__.py`, `WEBHOOK_BEFORE_REQUEST_HANDLERS`), which is not loaded by default. 2. The guard validates but pins nothing — `mlflow/utils/validation.py` `_validate_webhook_url`: ```python schemes = _MLFLOW_WEBHOOK_ALLOWED_SCHEMES.get() # default [\"https\"] if parsed_url.scheme not in schemes: raise ... if not _MLFLOW_WEBHOOK_ALLOW_PRIVATE_IPS.get(): # default False for addr_info in socket.getaddrinfo(hostname, None): ip = ipaddress.ip_addre","evidence":"osv:GHSA-7gwp-5pfp-969j","products":[{"name":{"value":"mlflow","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.15.0","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"3.10.0","evidence":"/affected/0/versions"},{"value":"3.10.0rc0","evidence":"/affected/0/versions"},{"value":"3.10.1","evidence":"/affected/0/versions"},{"value":"3.11.0","evidence":"/affected/0/versions"},{"value":"3.11.0rc0","evidence":"/affected/0/versions"},{"value":"3.11.0rc1","evidence":"/affected/0/versions"},{"value":"3.11.1","evidence":"/affected/0/versions"},{"value":"3.12.0","evidence":"/affected/0/versions"},{"value":"3.12.0rc0","evidence":"/affected/0/versions"},{"value":"3.13.0","evidence":"/affected/0/versions"},{"value":"3.13.0rc0","evidence":"/affected/0/versions"},{"value":"3.14.0","evidence":"/affected/0/versions"},{"value":"3.3.0","evidence":"/affected/0/versions"},{"value":"3.3.1","evidence":"/affected/0/versions"},{"value":"3.3.2","evidence":"/affected/0/versions"},{"value":"3.4.0","evidence":"/affected/0/versions"},{"value":"3.4.0rc0","evidence":"/affected/0/versions"},{"value":"3.5.0","evidence":"/affected/0/versions"},{"value":"3.5.0rc0","evidence":"/affected/0/versions"},{"value":"3.5.1","evidence":"/affected/0/versions"},{"value":"3.6.0","evidence":"/affected/0/versions"},{"value":"3.6.0rc0","evidence":"/affected/0/versions"},{"value":"3.7.0","evidence":"/affected/0/versions"},{"value":"3.7.0rc0","evidence":"/affected/0/versions"},{"value":"3.8.0","evidence":"/affected/0/versions"},{"value":"3.8.0rc0","evidence":"/affected/0/versions"},{"value":"3.8.1","evidence":"/affected/0/versions"},{"value":"3.9.0","evidence":"/affected/0/versions"},{"value":"3.9.0rc0","evidence":"/affected/0/versions"}]}],"severity":"critical","structured":{"id":"GHSA-7gwp-5pfp-969j","aliases":["BIT-mlflow-2026-64849","CVE-2026-64849","GHSA-7gwp-5pfp-969j","PYSEC-2026-3687"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.15.0"}]}],"package":{"name":"mlflow","purl":"pkg:pypi/mlflow","ecosystem":"PyPI"},"versions":["3.10.0","3.10.0rc0","3.10.1","3.11.0","3.11.0rc0","3.11.0rc1","3.11.1","3.12.0","3.12.0rc0","3.13.0","3.13.0rc0","3.14.0","3.3.0","3.3.1","3.3.2","3.4.0","3.4.0rc0","3.5.0","3.5.0rc0","3.5.1","3.6.0","3.6.0rc0","3.7.0","3.7.0rc0","3.8.0","3.8.0rc0","3.8.1","3.9.0","3.9.0rc0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-7gwp-5pfp-969j/GHSA-7gwp-5pfp-969j.json"}}],"modified":"2026-10-02T18:30:39.856988982Z","provider":"osv","references":["https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j","https://nvd.nist.gov/vuln/detail/CVE-2026-64849","https://github.com/mlflow/mlflow/issues/24179","https://github.com/mlflow/mlflow/pull/24258","https://github.com/mlflow/mlflow/commit/ba949522477cbd5915aa55d29b0cfad7d5ddf939","https://github.com/advisories/GHSA-7gwp-5pfp-969j","https://github.com/mlflow/mlflow","https://github.com/mlflow/mlflow/releases/tag/v3.15.0","https://github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2026-3687.yaml","https://pypi.org/project/mlflow","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-64849"],"provider_metadata":{"cwe_ids":["CWE-918"],"severity":"CRITICAL","github_reviewed":true,"nvd_published_at":"2026-08-17T22:17:23Z","github_reviewed_at":"2026-08-17T21:58:51Z"}},"related_cves":[{"value":"CVE-2026-64849","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"osv:GHSA-7gwp-5pfp-969j","priority":{"reasons":["publisher_severity","linked_severity","known_exploited"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-64849","metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":9.3,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"mlflow","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64849","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-64849","metrics":[],"products":[{"name":{"value":"MLflow","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-64849","relationship":"advisory","known_exploited":true,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":true,"publisher_severity":"critical"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-7gwp-5pfp-969j","advisory_id":"5fe1fa61-7fc5-45f7-b11a-9586f3d40a1f","event_types":["advisory"],"published_at":"2026-10-25T22:45:50.32144+00:00","technologies":["core-osv","mlflow"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-17T21:58:51+00:00","detail_url":"/events/71335"},"members":[{"id":71335,"cve_ids":["CVE-2026-64849"],"payload":{"kind":"advisory","title":"MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)","summary":"### Summary The default MLflow Tracking Server (`mlflow server`, no authentication, default SQLite backend) exposes the model-registry webhooks API unauthenticated, including a synchronous `POST /api/2.0/mlflow/webhooks/{id}/test` endpoint that returns the upstream response status and body to the caller. The SSRF guard added in PR #20747 (`_validate_webhook_url`, shipped in 3.10.0) resolves the webhook hostname and rejects non-public IPs, but it is bypassable: delivery follows HTTP redirects (no `allow_redirects=False`) and never pins the validated IP. An attacker hosts a public HTTPS endpoint that passes the guard and returns `302 Location: http://169.254.169.254/...` (or `http://127.0.0.1:...`); MLflow follows it and never re-validates the redirect target. Because `/test` reflects the response body, this is an unauthenticated full-read SSRF on a default server. ### Details Three facts combine: 1. Webhook endpoints are unauthenticated on a default server. The only webhook authorization lives in the optional auth plugin (`mlflow/server/auth/__init__.py`, `WEBHOOK_BEFORE_REQUEST_HANDLERS`), which is not loaded by default. 2. The guard validates but pins nothing — `mlflow/utils/validation.py` `_validate_webhook_url`: ```python schemes = _MLFLOW_WEBHOOK_ALLOWED_SCHEMES.get() # default [\"https\"] if parsed_url.scheme not in schemes: raise ... if not _MLFLOW_WEBHOOK_ALLOW_PRIVATE_IPS.get(): # default False for addr_info in socket.getaddrinfo(hostname, None): ip = ipaddress.ip_addre","evidence":"osv:GHSA-7gwp-5pfp-969j","products":[{"name":{"value":"mlflow","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.15.0","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"3.10.0","evidence":"/affected/0/versions"},{"value":"3.10.0rc0","evidence":"/affected/0/versions"},{"value":"3.10.1","evidence":"/affected/0/versions"},{"value":"3.11.0","evidence":"/affected/0/versions"},{"value":"3.11.0rc0","evidence":"/affected/0/versions"},{"value":"3.11.0rc1","evidence":"/affected/0/versions"},{"value":"3.11.1","evidence":"/affected/0/versions"},{"value":"3.12.0","evidence":"/affected/0/versions"},{"value":"3.12.0rc0","evidence":"/affected/0/versions"},{"value":"3.13.0","evidence":"/affected/0/versions"},{"value":"3.13.0rc0","evidence":"/affected/0/versions"},{"value":"3.14.0","evidence":"/affected/0/versions"},{"value":"3.3.0","evidence":"/affected/0/versions"},{"value":"3.3.1","evidence":"/affected/0/versions"},{"value":"3.3.2","evidence":"/affected/0/versions"},{"value":"3.4.0","evidence":"/affected/0/versions"},{"value":"3.4.0rc0","evidence":"/affected/0/versions"},{"value":"3.5.0","evidence":"/affected/0/versions"},{"value":"3.5.0rc0","evidence":"/affected/0/versions"},{"value":"3.5.1","evidence":"/affected/0/versions"},{"value":"3.6.0","evidence":"/affected/0/versions"},{"value":"3.6.0rc0","evidence":"/affected/0/versions"},{"value":"3.7.0","evidence":"/affected/0/versions"},{"value":"3.7.0rc0","evidence":"/affected/0/versions"},{"value":"3.8.0","evidence":"/affected/0/versions"},{"value":"3.8.0rc0","evidence":"/affected/0/versions"},{"value":"3.8.1","evidence":"/affected/0/versions"},{"value":"3.9.0","evidence":"/affected/0/versions"},{"value":"3.9.0rc0","evidence":"/affected/0/versions"}]}],"severity":"critical","structured":{"id":"GHSA-7gwp-5pfp-969j","aliases":["BIT-mlflow-2026-64849","CVE-2026-64849","GHSA-7gwp-5pfp-969j","PYSEC-2026-3687"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.15.0"}]}],"package":{"name":"mlflow","purl":"pkg:pypi/mlflow","ecosystem":"PyPI"},"versions":["3.10.0","3.10.0rc0","3.10.1","3.11.0","3.11.0rc0","3.11.0rc1","3.11.1","3.12.0","3.12.0rc0","3.13.0","3.13.0rc0","3.14.0","3.3.0","3.3.1","3.3.2","3.4.0","3.4.0rc0","3.5.0","3.5.0rc0","3.5.1","3.6.0","3.6.0rc0","3.7.0","3.7.0rc0","3.8.0","3.8.0rc0","3.8.1","3.9.0","3.9.0rc0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-7gwp-5pfp-969j/GHSA-7gwp-5pfp-969j.json"}}],"modified":"2026-10-02T18:30:39.856988982Z","provider":"osv","references":["https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j","https://nvd.nist.gov/vuln/detail/CVE-2026-64849","https://github.com/mlflow/mlflow/issues/24179","https://github.com/mlflow/mlflow/pull/24258","https://github.com/mlflow/mlflow/commit/ba949522477cbd5915aa55d29b0cfad7d5ddf939","https://github.com/advisories/GHSA-7gwp-5pfp-969j","https://github.com/mlflow/mlflow","https://github.com/mlflow/mlflow/releases/tag/v3.15.0","https://github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2026-3687.yaml","https://pypi.org/project/mlflow","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-64849"],"provider_metadata":{"cwe_ids":["CWE-918"],"severity":"CRITICAL","github_reviewed":true,"nvd_published_at":"2026-08-17T22:17:23Z","github_reviewed_at":"2026-08-17T21:58:51Z"}},"related_cves":[{"value":"CVE-2026-64849","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"osv:GHSA-7gwp-5pfp-969j","priority":{"reasons":["publisher_severity","linked_severity","known_exploited"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-64849","metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":9.3,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"mlflow","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64849","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-64849","metrics":[],"products":[{"name":{"value":"MLflow","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-64849","relationship":"advisory","known_exploited":true,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":true,"publisher_severity":"critical"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-7gwp-5pfp-969j","advisory_id":"5fe1fa61-7fc5-45f7-b11a-9586f3d40a1f","event_types":["advisory"],"published_at":"2026-10-25T22:45:50.32144+00:00","technologies":["core-osv","mlflow"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-17T21:58:51+00:00","detail_url":"/events/71335"}]}}],"next_after":70964,"next_before":70964}