CVE-2026-64849: independent discovery in MLflow
By John Daniel Kearney ·
John Daniel Kearney / Research contributions / CVE-2026-64849
A finding that reached the public security record
I independently discovered and publicly reported a webhook vulnerability in MLflow. The published advisory credits me, under @AUTHENSOR, as an independent finder of CVE-2026-64849.
CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on 19 August 2026. Its entry cites both my public disclosure and the maintainer’s fix.
The trust boundary that failed
The webhook URL check resolved a hostname and rejected private addresses. Delivery could resolve that hostname again. A destination that passed the first check could therefore lead to a different address at connection time. This is the DNS-rebinding path in the broader webhook server-side request forgery advisory.
The important question was whether the server enforced its network policy at the moment it actually connected. My report #24179 documented that gap through source review and a reproducible finding.
Independent discovery, followed by an upstream fix
The advisory records my independent public report on 26 June 2026. It also records an earlier private report by freeman-bb, who holds original discovery priority. My contribution is the independent discovery and public disclosure credited in that record.
Maintainer PattaraS implemented the repair in PR #24258. The fix checks the actual connected peer’s IP before the TLS or HTTP exchange, enforcing the public-address rule at the connection rather than relying only on an earlier DNS result.
Why the CISA citation matters
The CISA KEV catalog identifies vulnerabilities known to have been exploited in the wild. This places CVE-2026-64849 in the operational security record used to prioritize remediation.
The official source data lists MLflow, CVE-2026-64849, the 19 August addition date, and links to report #24179 and fix #24258. The advisory supplies the independent-finder attribution; CISA supplies the exploitation catalog entry and citation.
The connection to my AI security research
I research how AI systems can cross the boundaries their designers expect to hold: a candidate response influencing its own grade, an agent controlling evidence used to judge it, or untrusted input affecting a privileged action. MLflow’s webhook boundary is a concrete example from the infrastructure around machine learning.
My work on UK AISI evaluation tools, SWE-bench, Promptfoo and NVIDIA garak follows the same practical method: inspect the real execution path, reproduce the failure and work toward an accepted repair. I study the broader evaluation problem in The Evaluator Trust Boundary, a research preprint.
Primary sources
John Daniel Kearney
AI security and evaluation researcher. Founder of AUTHENSOR. SPAR fellow working with Sampura Research.
I publish research as John Kearney and filed this disclosure under the AUTHENSOR handle.