vulns.co
/
GKData.io MCP

MLflow · 2 min read

MLflow: destination validation must remain bound to the actual connection

MLflow's initial webhook destination check did not necessarily validate the address used for the actual connection. The repair for CVE-2026-64849 explains that validation and connection setup could make different address decisions. The lesson is to enforce destination restrictions when the connection is used, rather than rely only on an earlier check.

Open the reference Maintainer AdvisoryReviewed 2026-10-05

How to use this reference

The connection-fix PR moves enforcement to the connected peer before TLS or HTTP exchange, retaining initial validation as defense in depth. The classification-fix PR later gives initial and connection-time checks the same address-normalization policy. Editorial lesson: define one destination invariant, enforce it at the point of use, and keep representation handling consistent across layers. Review deployment controls and later remediation evidence together; historical fixed-version labels do not prove comprehensive or current protection.

Before reading

  • Server-side HTTP clients and the distinction between configured destinations and connected peers
  • Time-of-check versus time-of-use reasoning and consistent address classification

Context and limits

  • The described unauthenticated case requires a reachable OSS tracking server with SQL-backed webhooks and authentication absent. It does not establish exposure for every deployment.
  • The repository advisory lists >=3.10.0, <3.15.0 as affected; the GitHub Advisory Database lists >=3.3.0, <3.15.0. Both name 3.15.0 as the initial patched version. The lower-bound disagreement remains unresolved here; versions before 3.10.0 must not be assumed unaffected.
  • The advisory reports a synthetic local-service response disclosure on 3.13.0. Production compromise, actual cloud credential theft and service shutdown are not established by that demonstration.
  • Connection-fix PR #24258 merged July 2, 2026; release 3.15.0 on July 31 includes it. These software events precede the August 2 advisory publication.
  • Classification-fix PR #25568 merged September 3, 2026; PR #25578 backported it for 3.16.0 on September 4, the release date. This follow-on hardening addresses address representations missed by the earlier classifier. It qualifies the initial patch claim and is remediation context for this single case, not a separate counted finding or a guarantee about the latest safe release.
  • PattaraS published the advisory. Credits name freeman-bb as Reporter and y011d4, ibondarenko1, h1-mrz and th3cyb3rc0p as Finders; the narrative separately credits AUTHENSOR with independent discovery. No separate narrative-author byline was established, so authors remains empty.
  • The database records its own publication and review on August 17, 2026 and an October 2 update; neither replaces the original August 2 publication. Its Analyst credit for cwchong is distinct from the repository Reporter and Finder credits.
  • No qualifying individual award is established. Learning prerequisites and generalized design guidance are editorial. This educational resource grants no testing authorization.

Sources and provenance

  1. MLflow webhook security advisory GHSA-7gwp-5pfp-969j MLflow · reviewed 2026-10-05
  2. GitHub Advisory Database entry for CVE-2026-64849 GitHub Advisory Database · reviewed 2026-10-05
  3. MLflow PR #24258: connection-time webhook destination protection MLflow · reviewed 2026-10-05
  4. MLflow 3.15.0 release notes MLflow · reviewed 2026-10-05
  5. MLflow PR #25568: consistent address classification MLflow · reviewed 2026-10-05
  6. MLflow PR #25578: address-classification hardening backport MLflow · reviewed 2026-10-05
  7. MLflow 3.16.0 release notes MLflow · reviewed 2026-10-05

Record reviewed 2026-10-05. Snapshot cb017eaea66e. Open the complete JSON contract.

GitHub snapshot 2026-10-12

cb017eaea66e · JSON exports & schemas · CC BY 4.0 content / MIT software