MLflow SSRF flaw enters CISA's exploited list

MLflow’s CVE-2026-64849 is a CVSS 9.3 server-side request-forgery flaw, and NIST’s vulnerability record notes that CISA added it to the Known Exploited Vulnerabilities catalog on August 19. The project’s security advisory says versions before 3.15.0 are affected and the flaw can expose internal services or cloud metadata; the fix is to upgrade. Teams running MLflow tracking servers should patch and review access logs now, alongside the archive’s case for named owners in AI security.