MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
PyPI mlflow · Upgrade to 3.15.0 or later · >= 3.3.0, < 3.15.0 · CVE-2026-64849 · GHSA-7gwp-5pfp-969j · amended