A server-side request forgery in MLflow (CVE-2026-64849) — a route that reaches the cloud metadata service

1SSRF: making the server fetch it for you

Server-side request forgery is a flaw where a server fetches whatever URL it is handed. The attacker sits outside and cannot reach the internal network; the server sits inside. If the attacker can ask that server to go and look at a location, they receive information from somewhere they could never reach themselves. The premise of defending at a boundary stops working for a request that originates within it.

2The destination named: cloud metadata services

What weighs most in the catalog wording is that cloud metadata services are named as a destination. Major clouds give a virtual machine or container a fixed, internally reachable address at which it can retrieve its own configuration and the temporary credentials assigned to that instance. Reaching it may let an attacker borrow that instance's privileges.

And here the response body itself is said to come back, which is a different matter from merely being able to reach the endpoint.

3Where MLflow sits

MLflow is used to record machine learning experiments, version models, and store artifacts. It usually lives close to the training compute — that is, in the environment where data and compute privileges gather. It is also commonly stood up internally as a development tool, which makes hardening for exposure easy to defer. From an attacker's view it is an inward-facing service located where privileges concentrate.

4Reaching it, or reading it back

Server-side request forgery comes in a form that stops at showing a service exists internally, and a form that returns the body of the response. This record is the latter.

What weighs most in the catalog entry is that cloud metadata services are named as the destination. On major clouds, a virtual machine or container retrieves its own configuration and the temporary credentials assigned to that instance from a fixed address reachable only internally. MLflow is usually placed near the compute used for training — that is, where data and compute privilege gather.