CVE-2026-64849
Known exploited · CISA KEV
CVSS 9.3 CRITICAL: mLflow is an open source AI engineering platform for agents, large language models, and machine learning models.
CISA federal remediation date Sep 2
Vulnerabilities · 54 days ago
Attackers are already abusing MLflow CVE-2026-64849, a critical unauthenticated server-side request forgery in versions before 3.15.0, and watchTowr says it saw indiscriminate scanning and cloud credential theft within hours of the flaw being assigned. The issue sits in the model-registry webhook test endpoint.
MLflow checked the original webhook URL, then followed redirects and re-resolved the host without keeping the validated address fixed. That lets a crafted request bounce into internal metadata services and return their data, so a reachable tracking server can expose cloud instance metadata and the credentials behind it instead of just internal HTTP responses.
For cloud-hosted MLflow deployments, the exposure now reaches into whatever cloud role the server can reach, and patching only closes the entry point for future requests. Any secrets already pulled from metadata remain a separate problem, and the reporting still leaves the scale of compromise to each operator's own logs and cloud controls.
Known exploited · CISA KEV
CVSS 9.3 CRITICAL: mLflow is an open source AI engineering platform for agents, large language models, and machine learning models.
CISA federal remediation date Sep 2
4 sources covering this story
MLflow Vulnerability Exploited for Cloud Credential Theft
The critical-severity flaw allows attackers to send HTTP requests to internal endpoints and extract sensitive information.
CISA warns of hackers exploiting critical MLflow vulnerability
The Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies that threat actors are now exploiting a critical vulnerability in the MLflow open-source AI engineering platform.
Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets
Attackers exploit MLflow CVE-2026-64849 via SSRF to steal cloud credentials, while FUXA CVE-2026-25895 draws malicious scanning.
Falsificación de solicitudes del lado del servidor (SSRF) no autenticado en MLflow
MLflow ha informado de una vulnerabilidad de severidad crítica que, en caso de ser explotada, podría p
Part of the PlainSec briefing for 2026-08-21