MLflow SSRF Is Already Harvesting Cloud Credentials
Attackers are already abusing MLflow CVE-2026-64849, a critical unauthenticated server-side request forgery in versions before 3.15.0, and watchTowr says it saw indiscriminate scanning and cloud credential theft within hours of the flaw being assigned. The issue sits in the model-registry webhook test endpoint.
MLflow checked the original webhook URL, then followed redirects and re-resolved the host without keeping the validated address fixed. That lets a crafted request bounce into internal metadata services and return their data, so a reachable tracking server can expose cloud instance metadata and the credentials behind it instead of just internal HTTP responses.
For cloud-hosted MLflow deployments, the exposure now reaches into whatever cloud role the server can reach, and patching only closes the entry point for future requests. Any secrets already pulled from metadata remain a separate problem, and the reporting still leaves the scale of compromise to each operator's own logs and cloud controls.