CVE-2026-64849
Known exploited · CISA KEV
CVSS 9.3 CRITICAL: mLflow is an open source AI engineering platform for agents, large language models, and machine learning models.
CISA federal remediation date Sep 2
Vulnerabilities & Exploits
Attackers are already abusing MLflow CVE-2026-64849, a critical unauthenticated server-side request forgery in versions before 3.15.0, and watchTowr says it saw indiscriminate scanning and cloud credential theft within hours of the flaw being assigned. The issue sits in the model-registry webhook test endpoint.
MLflow checked the original webhook URL, then followed redirects and re-resolved the host without keeping the validated address fixed. That lets a crafted request bounce into internal metadata services and return their data, so a reachable tracking server can expose cloud instance metadata and the credentials behind it instead of just internal HTTP responses.
For cloud-hosted MLflow deployments, the exposure now reaches into whatever cloud role the server can reach, and patching only closes the entry point for future requests. Any secrets already pulled from metadata remain a separate problem, and the reporting still leaves the scale of compromise to each operator's own logs and cloud controls.
4 sources · Aug 20
Known exploited · CISA KEV
CVSS 9.3 CRITICAL: mLflow is an open source AI engineering platform for agents, large language models, and machine learning models.
CISA federal remediation date Sep 2
SecurityWeek
MLflow Vulnerability Exploited for Cloud Credential Theft
The critical-severity flaw allows attackers to send HTTP requests to internal endpoints and extract sensitive information.
originalBleepingComputer
CISA warns of hackers exploiting critical MLflow vulnerability
The Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies that threat actors are now exploiting a critical vulnerability in the MLflow open-source AI engineering platform.
originalThe Hacker News
Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets
Attackers exploit MLflow CVE-2026-64849 via SSRF to steal cloud credentials, while FUXA CVE-2026-25895 draws malicious scanning.
originalPart of the PlainSec briefing for 2026-08-21
Every edition of this story: MLflow SSRF Is Already Harvesting Cloud Credentials