mlflow

This tag covers MLflow, the open-source machine learning lifecycle platform, with a focus on security and enterprise administration. Recent content highlights CVE-2026-64849, a critical server-side request forgery (SSRF) vulnerability in MLflow's webhook delivery feature, which CISA added to its Known Exploited Vulnerabilities catalog after confirming active exploitation. The discussions emphasize risks for self-hosted MLflow Tracking Servers exposed to the internet, which could be coerced into accessing internal services or cloud metadata endpoints. Administrators face challenges due to unclear patch guidance, as the advisory lacks specific affected versions and remediation deadlines. The tag serves as a resource for IT professionals managing MLflow deployments, particularly regarding vulnerability tracking, security hardening, and incident response in Windows-based or hybrid environments.