Vulnpedia
← All CVEs

CVE-2026-64849

CRITICAL 9.3 KNOWN EXPLOITED PoC CATALOGUED DETECTION TEMPLATE ALL-YEARS

Published 2026-08-17 · Last modified 2026-10-02 · GitHub_M · NVD: Analyzed

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0.

ACTIVELY EXPLOITED

Confirmed exploited in the wild — in CISA KEV since 2026-08-19. Patch or mitigate now.

Exploitation likelihood

10.0%chance of exploitation in 30 days · 96th percentile

● In CISA KEV (2026-08-19)● Catalogued PoC◆ SSVC: exploitation active, automatable yes

Impact if exploited

9.3CVSS 3.1 · CRITICAL · CNA

  • ConfidentialityHigh
  • IntegrityLow
  • AvailabilityNone

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

Public PoC or exploit resources are catalogued below.

Listed by the named source; Vulnpedia has not tested these resources.

PoC data: JSON

Detection templates

Detection checks are listed separately from PoCs.

Resource commands

nuclei -id CVE-2026-64849 -u https://TARGETDetection template — review its checks and affected versions before use.
curl -s https://vulnpedia.com/cve/CVE-2026-64849/poc.jsonMachine-readable PoC index for this CVE (for automation).

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Mlflow Lfprojects

Products Mlflow

Weakness (CWE)

  • CWE-918: : Server-Side Request Forgery (SSRF)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

References and research data (JSON)

Packages and version ranges

Each advisory describes its own package and affected ranges. A boundary applies to that range; it is not a universal upgrade recommendation.

  • mlflow PyPI

    pkg:pypi/mlflow

    ECOSYSTEM range
    • Introduced version (included): 3.3.0
    • Fixed boundary (excluded): 3.15.0
    29 explicitly listed affected versions

    3.10.0, 3.10.0rc0, 3.10.1, 3.11.0, 3.11.0rc0, 3.11.0rc1, 3.11.1, 3.12.0, 3.12.0rc0, 3.13.0, 3.13.0rc0, 3.14.0, 3.3.0, 3.3.1, 3.3.2, 3.4.0, 3.4.0rc0, 3.5.0, 3.5.0rc0, 3.5.1, 3.6.0, 3.6.0rc0, 3.7.0, 3.7.0rc0, 3.8.0, 3.8.0rc0, 3.8.1, 3.9.0, 3.9.0rc0

    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-7gwp-5pfp-969j/GHSA-7gwp-5pfp-969j.json"
  }
}
    GitHub Advisory Database · GHSA-7gwp-5pfp-969j · Updated 2026-10-02T18:30:39.856988982Z
  • mlflow PyPI

    pkg:pypi/mlflow

    ECOSYSTEM range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 3.15.0
    182 explicitly listed affected versions

    0.0.1, 0.1.0, 0.2.0, 0.2.1, 0.3.0, 0.4.0, 0.4.1, 0.4.2, 0.5.0, 0.5.1, 0.5.2, 0.6.0, 0.7.0, 0.8.0, 0.8.1, 0.8.2, 0.9.0, 0.9.0.1, 0.9.1, 1.0.0, 1.1.0, 1.1.1.dev0, 1.10.0, 1.11.0, 1.12.0, 1.12.1, 1.13, 1.13.1, 1.14.0, 1.14.1, 1.15.0, 1.16.0, 1.17.0, 1.18.0, 1.19.0, 1.2.0, 1.20.0, 1.20.1, 1.20.2, 1.21.0, 1.22.0, 1.23.0, 1.23.1, 1.24.0, 1.25.0, 1.25.1, 1.26.0, 1.26.1, 1.27.0, 1.28.0, 1.29.0, 1.3.0, 1.30.0, 1.30.1, 1.4.0, 1.5.0, 1.6.0, 1.7.0, 1.7.1, 1.7.2, 1.8.0, 1.9.0, 1.9.1, 2.0.0, 2.0.0rc0, 2.0.1, 2.1.0, 2.1.1, 2.10.0, 2.10.1, 2.10.2, 2.11.0, 2.11.1, 2.11.2, 2.11.3, 2.11.4, 2.12.0, 2.12.1, 2.12.2, 2.13.0, 2.13.1, 2.13.2, 2.14.0, 2.14.0rc0, 2.14.1, 2.14.2, 2.14.2.dev0, 2.14.3, 2.15.0, 2.15.0rc0, 2.15.1, 2.16.0, 2.16.1, 2.16.2, 2.17.0, 2.17.0rc0, 2.17.1, 2.17.2, 2.18.0, 2.18.0rc0, 2.19.0, 2.19.0rc0, 2.2.0, 2.2.1, 2.2.2, 2.20.0, 2.20.0rc0, 2.20.1, 2.20.2, 2.20.3, 2.20.4, 2.21.0, 2.21.0rc0, 2.21.1, 2.21.2, 2.21.3, 2.22.0, 2.22.0rc0, 2.22.1, 2.22.2, 2.22.3, 2.22.4, 2.22.5, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.4.2, 2.5.0, 2.6.0, 2.7.0, 2.7.1, 2.8.0, 2.8.1, 2.9.0, 2.9.1, 2.9.2, 3.0.0, 3.0.0rc0, 3.0.0rc1, 3.0.0rc2, 3.0.0rc3, 3.0.1, 3.1.0, 3.1.0rc0, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.10.0, 3.10.0rc0, 3.10.1, 3.11.0, 3.11.0rc0, 3.11.0rc1, 3.11.1, 3.12.0, 3.12.0rc0, 3.13.0, 3.13.0rc0, 3.14.0, 3.2.0, 3.2.0rc0, 3.3.0, 3.3.0rc0, 3.3.1, 3.3.2, 3.4.0, 3.4.0rc0, 3.5.0, 3.5.0rc0, 3.5.1, 3.6.0, 3.6.0rc0, 3.7.0, 3.7.0rc0, 3.8.0, 3.8.0rc0, 3.8.1, 3.9.0, 3.9.0rc0

    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/pypa/advisory-database/blob/main/vulns/mlflow/PYSEC-2026-3687.yaml"
  }
}
    PyPA · PYSEC-2026-3687 · Updated 2026-08-21T08:40:32.349552541Z

Vendor product assessments

Showing 32 of 343 vendor product statements; 311 omitted. Read the full vendor advisory.

  • registry.redhat.io/rhoai/odh-mlflow-rhel9@sha256:2feba54cbd221a4786bcab320c8438816b0632df71f82f23b123ed4a4a111210_ppc64le as a component of Red Hat OpenShift AI 3.4 · fixed

    Vendor assessment for this product only.

    pkg:oci/odh-mlflow-rhel9@sha256%3A2feba54cbd221a4786bcab320c8438816b0632df71f82f23b123ed4a4a111210?arch=ppc64le&repository_url=registry.redhat.io/rhoai/odh-mlflow-rhel9&tag=1787226790

    • vendor fix: For Red Hat OpenShift AI 3.4.4 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Vendor guidance
    • workaround: To reduce the attack surface for this vulnerability, restrict network access to the MLflow server. Implement firewall rules or network access controls to limit connectivity to the MLflow instance from untrusted networks. This operational control helps prevent unauthenticated attackers from reaching the vulnerable webhook test endpoint.
    Red Hat · CVE-2026-64849 · Updated 2026-10-15T03:01:00+00:00
  • registry.redhat.io/rhoai/odh-mlflow-rhel9@sha256:304991bad591fadfed03b7f56ff6c265a6416e2e13fe02129dc253db4e13092f_s390x as a component of Red Hat OpenShift AI 3.4 · fixed

    Vendor assessment for this product only.

    pkg:oci/odh-mlflow-rhel9@sha256%3A304991bad591fadfed03b7f56ff6c265a6416e2e13fe02129dc253db4e13092f?arch=s390x&repository_url=registry.redhat.io/rhoai/odh-mlflow-rhel9&tag=1787226790

    • vendor fix: For Red Hat OpenShift AI 3.4.4 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Vendor guidance
    • workaround: To reduce the attack surface for this vulnerability, restrict network access to the MLflow server. Implement firewall rules or network access controls to limit connectivity to the MLflow instance from untrusted networks. This operational control helps prevent unauthenticated attackers from reaching the vulnerable webhook test endpoint.
    Red Hat · CVE-2026-64849 · Updated 2026-10-15T03:01:00+00:00
  • registry.redhat.io/rhoai/odh-mlflow-rhel9@sha256:4cf62283b344149cbdaab95c7045df607d101745ff0657146de50087fbb2bfb5_amd64 as a component of Red Hat OpenShift AI 3.4 · fixed

    Vendor assessment for this product only.

    pkg:oci/odh-mlflow-rhel9@sha256%3A4cf62283b344149cbdaab95c7045df607d101745ff0657146de50087fbb2bfb5?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-mlflow-rhel9&tag=1787226790

    • vendor fix: For Red Hat OpenShift AI 3.4.4 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Vendor guidance
    • workaround: To reduce the attack surface for this vulnerability, restrict network access to the MLflow server. Implement firewall rules or network access controls to limit connectivity to the MLflow instance from untrusted networks. This operational control helps prevent unauthenticated attackers from reaching the vulnerable webhook test endpoint.
    Red Hat · CVE-2026-64849 · Updated 2026-10-15T03:01:00+00:00
  • registry.redhat.io/rhoai/odh-mlflow-rhel9@sha256:4e1d4dc5b792364e2cfb31cd20e184c01aeff4ae0fa55dfc3d68aafb2a50a7f5_arm64 as a component of Red Hat OpenShift AI 3.4 · fixed

    Vendor assessment for this product only.

    pkg:oci/odh-mlflow-rhel9@sha256%3A4e1d4dc5b792364e2cfb31cd20e184c01aeff4ae0fa55dfc3d68aafb2a50a7f5?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-mlflow-rhel9&tag=1787226790

    • vendor fix: For Red Hat OpenShift AI 3.4.4 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Vendor guidance
    • workaround: To reduce the attack surface for this vulnerability, restrict network access to the MLflow server. Implement firewall rules or network access controls to limit connectivity to the MLflow instance from untrusted networks. This operational control helps prevent unauthenticated attackers from reaching the vulnerable webhook test endpoint.
    Red Hat · CVE-2026-64849 · Updated 2026-10-15T03:01:00+00:00
  • registry.redhat.io/rhoai/odh-latency-predictor-prediction-rhel9@sha256:5743e64bd3a2947dc022830f2d769f4ff90daf04b3e6dcfaba6420815cdb52e5_arm64 as a component of Red Hat OpenShift AI 3.5 · fixed

    Vendor assessment for this product only.

    pkg:oci/odh-latency-predictor-prediction-rhel9@sha256%3A5743e64bd3a2947dc022830f2d769f4ff90daf04b3e6dcfaba6420815cdb52e5?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-latency-predictor-prediction-rhel9&tag=1786552271

    • vendor fix: For Red Hat OpenShift AI 3.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Vendor guidance
    • workaround: To reduce the attack surface for this vulnerability, restrict network access to the MLflow server. Implement firewall rules or network access controls to limit connectivity to the MLflow instance from untrusted networks. This operational control helps prevent unauthenticated attackers from reaching the vulnerable webhook test endpoint.
    Red Hat · CVE-2026-64849 · Updated 2026-10-15T03:01:00+00:00
  • registry.redhat.io/rhoai/odh-latency-predictor-prediction-rhel9@sha256:ada20174176992b0ee306e6eface5bff06f06a71783f3deccd530a5bc4fe80a1_amd64 as a component of Red Hat OpenShift AI 3.5 · fixed

    Vendor assessment for this product only.

    pkg:oci/odh-latency-predictor-prediction-rhel9@sha256%3Aada20174176992b0ee306e6eface5bff06f06a71783f3deccd530a5bc4fe80a1?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-latency-predictor-prediction-rhel9&tag=1786552271

    • vendor fix: For Red Hat OpenShift AI 3.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Vendor guidance
    • workaround: To reduce the attack surface for this vulnerability, restrict network access to the MLflow server. Implement firewall rules or network access controls to limit connectivity to the MLflow instance from untrusted networks. This operational control helps prevent unauthenticated attackers from reaching the vulnerable webhook test endpoint.
    Red Hat · CVE-2026-64849 · Updated 2026-10-15T03:01:00+00:00
  • registry.redhat.io/rhoai/odh-latency-predictor-training-rhel9@sha256:4f1a03f0801811aea4550346a041c079d1cbb80cdb6f128a513122eebe3f2cef_arm64 as a component of Red Hat OpenShift AI 3.5 · fixed

    Vendor assessment for this product only.

    pkg:oci/odh-latency-predictor-training-rhel9@sha256%3A4f1a03f0801811aea4550346a041c079d1cbb80cdb6f128a513122eebe3f2cef?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-latency-predictor-training-rhel9&tag=1786552250

    • vendor fix: For Red Hat OpenShift AI 3.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Vendor guidance
    • workaround: To reduce the attack surface for this vulnerability, restrict network access to the MLflow server. Implement firewall rules or network access controls to limit connectivity to the MLflow instance from untrusted networks. This operational control helps prevent unauthenticated attackers from reaching the vulnerable webhook test endpoint.
    Red Hat · CVE-2026-64849 · Updated 2026-10-15T03:01:00+00:00
  • registry.redhat.io/rhoai/odh-latency-predictor-training-rhel9@sha256:5bdb27b5f11d3057f9087b1e08e68b13e107541d595cbf9066d4f7a96a472ae9_amd64 as a component of Red Hat OpenShift AI 3.5 · fixed

    Vendor assessment for this product only.

    pkg:oci/odh-latency-predictor-training-rhel9@sha256%3A5bdb27b5f11d3057f9087b1e08e68b13e107541d595cbf9066d4f7a96a472ae9?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-latency-predictor-training-rhel9&tag=1786552250

    • vendor fix: For Red Hat OpenShift AI 3.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Vendor guidance
    • workaround: To reduce the attack surface for this vulnerability, restrict network access to the MLflow server. Implement firewall rules or network access controls to limit connectivity to the MLflow instance from untrusted networks. This operational control helps prevent unauthenticated attackers from reaching the vulnerable webhook test endpoint.
    Red Hat · CVE-2026-64849 · Updated 2026-10-15T03:01:00+00:00
  • registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9@sha256:170e78670297c1c9435cff22c3f227edd58dc30993ebd0cb3d8265de838210af_arm64 as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-ai-gateway-payload-processing-rhel9@sha256%3A170e78670297c1c9435cff22c3f227edd58dc30993ebd0cb3d8265de838210af?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9&tag=1787153594

    Red Hat · CVE-2026-64849 · Updated 2026-10-15T03:01:00+00:00
  • registry.redhat.io/rhoai/odh-built-in-detector-rhel9@sha256:e7d23a7fa4026469af734196cc0f56d5fdadd79eb5d04bb77c152019356ab679_arm64 as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-built-in-detector-rhel9@sha256%3Ae7d23a7fa4026469af734196cc0f56d5fdadd79eb5d04bb77c152019356ab679?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-built-in-detector-rhel9&tag=1786617316

    Red Hat · CVE-2026-64849 · Updated 2026-10-15T03:01:00+00:00
  • registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel9@sha256:5fa73ac9806750dba8388a9b3087f44d3cc82f015e620defd84f2adfe0301d50_ppc64le as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-data-science-pipelines-operator-controller-rhel9@sha256%3A5fa73ac9806750dba8388a9b3087f44d3cc82f015e620defd84f2adfe0301d50?arch=ppc64le&repository_url=registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel9&tag=1787002057

    Red Hat · CVE-2026-64849 · Updated 2026-10-15T03:01:00+00:00
  • registry.redhat.io/rhoai/odh-fms-guardrails-orchestrator-rhel9@sha256:ecb3df75edbb66483eb73be3ae3c8ff8cc0818bee21a3c9b1997a357987afd91_amd64 as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-fms-guardrails-orchestrator-rhel9@sha256%3Aecb3df75edbb66483eb73be3ae3c8ff8cc0818bee21a3c9b1997a357987afd91?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-fms-guardrails-orchestrator-rhel9&tag=1787360218

    Red Hat · CVE-2026-64849 · Updated 2026-10-15T03:01:00+00:00
  • registry.redhat.io/rhoai/odh-kserve-autogluon-server-rhel9@sha256:769be2c4b300be556e21d7de02fa65d187c6b6897db591ee769a89aa8af3ab3d_s390x as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-kserve-autogluon-server-rhel9@sha256%3A769be2c4b300be556e21d7de02fa65d187c6b6897db591ee769a89aa8af3ab3d?arch=s390x&repository_url=registry.redhat.io/rhoai/odh-kserve-autogluon-server-rhel9&tag=1786612609

    Red Hat · CVE-2026-64849 · Updated 2026-10-15T03:01:00+00:00
  • registry.redhat.io/rhoai/odh-kserve-storage-initializer-rhel9@sha256:1085077ef74b6a23ff7a93472d80301ba188f50937db9883300f3695276a3c4e_ppc64le as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-kserve-storage-initializer-rhel9@sha256%3A1085077ef74b6a23ff7a93472d80301ba188f50937db9883300f3695276a3c4e?arch=ppc64le&repository_url=registry.redhat.io/rhoai/odh-kserve-storage-initializer-rhel9&tag=1787073479

    Red Hat · CVE-2026-64849 · Updated 2026-10-15T03:01:00+00:00
  • registry.redhat.io/rhoai/odh-llama-stack-k8s-operator-rhel9@sha256:2a8295827300b494da0e2e89127fdfc5db56be6ecffdaf94c6b0199964c573fe_amd64 as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-llama-stack-k8s-operator-rhel9@sha256%3A2a8295827300b494da0e2e89127fdfc5db56be6ecffdaf94c6b0199964c573fe?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-llama-stack-k8s-operator-rhel9&tag=1787003492

    Red Hat · CVE-2026-64849 · Updated 2026-10-15T03:01:00+00:00
  • registry.redhat.io/rhoai/odh-llm-d-inference-scheduler-rhel9@sha256:04650101a70ed64e334a96753950a12fe18bf2852cb74dbd5599977132ac16bb_amd64 as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-llm-d-inference-scheduler-rhel9@sha256%3A04650101a70ed64e334a96753950a12fe18bf2852cb74dbd5599977132ac16bb?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-llm-d-inference-scheduler-rhel9&tag=1786611780

    Red Hat · CVE-2026-64849 · Updated 2026-10-15T03:01:00+00:00
  • registry.redhat.io/rhoai/odh-maas-controller-rhel9@sha256:7a0fb70187056361ebe58514e85ecc1e129766c41bd989ec79e5e00e51a53c34_arm64 as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-maas-controller-rhel9@sha256%3A7a0fb70187056361ebe58514e85ecc1e129766c41bd989ec79e5e00e51a53c34?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-maas-controller-rhel9&tag=1787153684

    Red Hat · CVE-2026-64849 · Updated 2026-10-15T03:01:00+00:00
  • registry.redhat.io/rhoai/odh-ml-pipelines-persistenceagent-v2-rhel9@sha256:8de883d2499e57aa803911e915c0abd866ff6cc302c75db4e704e605a8e10501_amd64 as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-ml-pipelines-persistenceagent-v2-rhel9@sha256%3A8de883d2499e57aa803911e915c0abd866ff6cc302c75db4e704e605a8e10501?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-ml-pipelines-persistenceagent-v2-rhel9&tag=1787332141

    Red Hat · CVE-2026-64849 · Updated 2026-10-15T03:01:00+00:00
  • registry.redhat.io/rhoai/odh-mod-arch-automl-rhel9@sha256:a4fc3da982bcaa1d7431f86350dd682bad49a1357a4c4e0a8f05e35bdafdb7f8_s390x as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-mod-arch-automl-rhel9@sha256%3Aa4fc3da982bcaa1d7431f86350dd682bad49a1357a4c4e0a8f05e35bdafdb7f8?arch=s390x&repository_url=registry.redhat.io/rhoai/odh-mod-arch-automl-rhel9&tag=1787250508

    Red Hat · CVE-2026-64849 · Updated 2026-10-15T03:01:00+00:00
  • registry.redhat.io/rhoai/odh-mod-arch-maas-rhel9@sha256:33ca5bc60d35bef45d2c5431455a2343c33ff4f68206a204fa5dcbbef1c8fd61_s390x as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-mod-arch-maas-rhel9@sha256%3A33ca5bc60d35bef45d2c5431455a2343c33ff4f68206a204fa5dcbbef1c8fd61?arch=s390x&repository_url=registry.redhat.io/rhoai/odh-mod-arch-maas-rhel9&tag=1787251250

    Red Hat · CVE-2026-64849 · Updated 2026-10-15T03:01:00+00:00
  • registry.redhat.io/rhoai/odh-model-controller-rhel9@sha256:f0bc48c41f95caffbdf209b5a0585f76e207429774da78705d6343922700643c_arm64 as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-model-controller-rhel9@sha256%3Af0bc48c41f95caffbdf209b5a0585f76e207429774da78705d6343922700643c?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-model-controller-rhel9&tag=1787207331

    Red Hat · CVE-2026-64849 · Updated 2026-10-15T03:01:00+00:00
  • registry.redhat.io/rhoai/odh-model-registry-operator-rhel9@sha256:9e1b17341da14ede30d08cd51a8efd363a32340cdd65e4eb3abe9e4937973786_s390x as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-model-registry-operator-rhel9@sha256%3A9e1b17341da14ede30d08cd51a8efd363a32340cdd65e4eb3abe9e4937973786?arch=s390x&repository_url=registry.redhat.io/rhoai/odh-model-registry-operator-rhel9&tag=1787103216

    Red Hat · CVE-2026-64849 · Updated 2026-10-15T03:01:00+00:00
  • registry.redhat.io/rhoai/odh-must-gather-rhel9@sha256:97317c8bedd59e864fcedaf492f5867315b25ef27764069323bbbbeb570ebf23_amd64 as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-must-gather-rhel9@sha256%3A97317c8bedd59e864fcedaf492f5867315b25ef27764069323bbbbeb570ebf23?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-must-gather-rhel9&tag=1786611326

    Red Hat · CVE-2026-64849 · Updated 2026-10-15T03:01:00+00:00
  • registry.redhat.io/rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9@sha256:f63b31c251afd3260357876fdbc5fc9521df4803875110f94916b10cfbb94c86_amd64 as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-pipeline-runtime-pytorch-cuda-py312-rhel9@sha256%3Af63b31c251afd3260357876fdbc5fc9521df4803875110f94916b10cfbb94c86?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9&tag=1787073873

    Red Hat · CVE-2026-64849 · Updated 2026-10-15T03:01:00+00:00
  • registry.redhat.io/rhoai/odh-rhel9-operator@sha256:3b8f50c575b12c8ce89d42bb72085e153aa564c28786dcdfaa5c89d6afe6d30c_ppc64le as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-rhel9-operator@sha256%3A3b8f50c575b12c8ce89d42bb72085e153aa564c28786dcdfaa5c89d6afe6d30c?arch=ppc64le&repository_url=registry.redhat.io/rhoai/odh-rhel9-operator&tag=1787569821

    Red Hat · CVE-2026-64849 · Updated 2026-10-15T03:01:00+00:00
  • registry.redhat.io/rhoai/odh-th06-cpu-torch210-py312-rhel9@sha256:cdd7d9f982c1f8a94dd4aad43e705274aae1bf0942e0442e60c3973f9c198f23_amd64 as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-th06-cpu-torch210-py312-rhel9@sha256%3Acdd7d9f982c1f8a94dd4aad43e705274aae1bf0942e0442e60c3973f9c198f23?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-th06-cpu-torch210-py312-rhel9&tag=1787076778

    Red Hat · CVE-2026-64849 · Updated 2026-10-15T03:01:00+00:00
  • registry.redhat.io/rhoai/odh-training-operator-rhel9@sha256:897df9e158d695a06f527c02e20635b7a0fed5dd8cfd832a0f9820b6abc3de09_arm64 as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-training-operator-rhel9@sha256%3A897df9e158d695a06f527c02e20635b7a0fed5dd8cfd832a0f9820b6abc3de09?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-training-operator-rhel9&tag=1787361677

    Red Hat · CVE-2026-64849 · Updated 2026-10-15T03:01:00+00:00
  • registry.redhat.io/rhoai/odh-trustyai-service-operator-rhel9@sha256:a557a55432d276334a562b40c856db05bdb44ba859b88013925e777b01dbc10b_ppc64le as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-trustyai-service-operator-rhel9@sha256%3Aa557a55432d276334a562b40c856db05bdb44ba859b88013925e777b01dbc10b?arch=ppc64le&repository_url=registry.redhat.io/rhoai/odh-trustyai-service-operator-rhel9&tag=1786614608

    Red Hat · CVE-2026-64849 · Updated 2026-10-15T03:01:00+00:00
  • registry.redhat.io/rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9@sha256:8b383544df737cf00bac9ce111db652e418e7c5afac87178545e81d63dda5396_ppc64le as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-workbench-codeserver-datascience-cpu-py312-rhel9@sha256%3A8b383544df737cf00bac9ce111db652e418e7c5afac87178545e81d63dda5396?arch=ppc64le&repository_url=registry.redhat.io/rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9&tag=1787121387

    Red Hat · CVE-2026-64849 · Updated 2026-10-15T03:01:00+00:00
  • registry.redhat.io/rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9@sha256:e15a412f74c1a63d3228cf473766769cc25245c29f84f189b82998fea7ed0524_amd64 as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-workbench-jupyter-pytorch-rocm-py312-rhel9@sha256%3Ae15a412f74c1a63d3228cf473766769cc25245c29f84f189b82998fea7ed0524?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9&tag=1787073546

    Red Hat · CVE-2026-64849 · Updated 2026-10-15T03:01:00+00:00
  • rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9?repository_url=registry.redhat.io/rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9

    Red Hat · CVE-2026-64849 · Updated 2026-10-15T03:01:00+00:00
  • rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-workbench-jupyter-trustyai-cpu-py312-rhel9?repository_url=registry.redhat.io/rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9

    Red Hat · CVE-2026-64849 · Updated 2026-10-15T03:01:00+00:00

Unverified PoC candidates

Catalogue matches for further research. These repositories have not been validated as working exploits.

5 candidates

Additional exploitation reports

Source-specific reports, separate from CISA KEV. Repeated observations from one source are not independent confirmations.

4 more source reports

Known Affected Software Configurations

VendorProductVersion range
LfprojectsMlflow≥ 3.3.0 and < 3.15.0

All CVSS metrics

  • CRITICAL 9.3 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
  • CRITICAL 9.3 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

References

Exploit-tagged references (not proof of a PoC)

Patches & mitigations

Advisories

Technical & other

Sources: NVD · CVE.org · All sources and attribution · EPSS