MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0.

The version of MLflow installed on the remote host is prior to 3.15.0. It is, therefore, affected by a server-side request forgery vulnerability:

  - The unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls
    _validate_webhook_url() only for the original URL while the webhook delivery follows     redirects and re-resolves the hostname without pinning the validated address, allowing     attackers to reach internal or cloud metadata services and receive response_status and     response_body. (CVE-2026-64849)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the self-reported version in its response header, the version of LobeChat hosted on the remote web server is prior to 3.15.0. It is, therefore, affected by an unauthenticated full-read Server-Side Request Forgery in webhook delivery.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - MLflow is an open source AI engineering platform for agents, large language models, and machine learning
    models. Prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls
    _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while
    mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated
    address, allowing attackers to reach internal or cloud metadata services and receive response_status and
    response_body. This issue is fixed in version 3.15.0. (CVE-2026-64849)

ID	Name	Product	Family	Type	Severity
338765	MLflow < 3.15.0 SSRF (CVE-2026-64849)	Nessus	Artificial Intelligence	Combined	critical
115434	MLflow < 3.15.0 Server-Side Request Forgery	Web App Scanning	Artificial Intelligence	Version Based	critical
446033	SCA: security update for mlflow (GHSA-7gwp-5pfp-969j)	Tenable Cloud Security	SCA Checks	Local	critical
446033	SCA: security update for mlflow (GHSA-7gwp-5pfp-969j)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical

Detections

Analytics

CVE-2026-64849

critical

Tenable Plugins

critical

critical

critical

critical