(MLflow, CVE-2026-64849, August 2026) By Pablo Bleck, Engineering Manager & Software Engineer, ActiveState MLflow shipped its webhook API open by default across a platform with more than 30 million monthly downloads, and a CISA listing turned that unauthenticated endpoint into a 14-day deadline. The questions that would have caught it earlier are the ones most PR reviews skip under deadline pressure. TL;DR CISA added CVE-2026-64849, an unauthenticated SSRF bypass in MLflow's webhook system, to its Known Exploited Vulnerabilities catalog, landing it in BOD 26-04's 14-day remediation tier for federal agencies. MLflow's default tracking server configuration shipped the webhook API open by default, part of a platform with more than 30 million monthly downloads; the flaw let attackers reach internal, loopback, and cloud-metadata endpoints and steal cloud credentials, including AWS IAM keys. MLflow 3.15.0 fixes the flaw, but the patch is the easy part; the expensive part is ...