Critical MLflow SSRF Vulnerability Actively Exploited for Cloud Credential Theft
A critical Server-Side Request Forgery (SSRF) vulnerability in MLflow, CVE-2026-64849, is being actively exploited in the wild to steal cloud credentials and sensitive tokens from internet-exposed instances.
Threat actors are actively exploiting a critical, unauthenticated server-side request forgery (SSRF) vulnerability in MLflow, the popular open-source platform widely used by data engineering and machine learning teams to track experiments, package code, and deploy models. Tracked as CVE-2026-64849 with a critical CVSS 3.1 score of 9.3, the flaw impacts all MLflow versions prior to 3.15.0. Threat monitoring by watchTowr Intel through its global Attacker Eye honeypot sensor network identified adversaries targeting internet-exposed MLflow instances within hours of public disclosure to harvest cloud credentials and sensitive deployment tokens.
A default MLflow Tracking Server initialized via mlflow server runs without mandatory authentication and relies on a local SQLite backend, exposing the model-registry webhooks API to untrusted network traffic. The primary vulnerability path resides in an unauthenticated POST request to /api/2.0/mlflow/webhooks/{id}/test. Rather than simply firing the designated webhook, the endpoint reflects the full upstream HTTP status code and response body back to the requester, converting a standard blind request-forgery into a high-impact, full-read primitive.
While MLflow previously introduced the _validate_webhook_url() helper in version 3.10.0 to reject private and cloud metadata addresses, the validation only evaluates the initial destination. The underlying delivery handler in mlflow/webhooks/delivery.py continues to follow HTTP redirects without re-validating the secondary address. An attacker can configure a public endpoint that passes initial checks and returns an HTTP 302 redirect pointing toward link-local cloud metadata services or internal loopback interfaces. Furthermore, because the hostname resolves again following the initial allowlist verification, the interface remains susceptible to DNS-rebinding attacks. Similar architectural flaws have surfaced in other SSRF bypass vulnerabilities across machine learning frameworks.
According to watchTowr Cyber Intelligence, automated scanners began hitting cloud-hosted MLflow endpoints almost immediately after the vulnerability received its official identifier. On major cloud providers including Amazon Web Services, Microsoft Azure, and Google Cloud Platform, the reflected response allows attackers to extract temporary IAM role credentials, OAuth tokens, and environment configurations from the link-local metadata address at http://169.254.169.254/. Beyond cloud provider metadata, the exploit can query internal microservices and loopback administrative consoles that implicitly trust the host environment.
The velocity of these intrusions mirrors broader trends where automated scanners rapidly weaponize zero-click software vulnerabilities against exposed enterprise infrastructure. Maintainers have resolved the redirect and DNS-rebinding exposure in MLflow 3.15.0 via pull request 24258. Organizations operating internet-facing or shared Tracking Servers must immediately upgrade to version 3.15.0 or later.
Because applying patches does not revoke credentials that may have already been exfiltrated, security teams must audit access logs for requests directed to /webhooks/*/test, rotate all cloud IAM keys and API secrets assigned to host instances, and enforce network egress filtering to restrict unauthorized communication with link-local metadata addresses. Executing rigorous emergency patch management and placing MLflow behind identity-aware proxies ensures that internal tracking portals remain isolated from public scanning networks.
This new report details a second critical vulnerability affecting MLflow, CVE-2026-25895, a path traversal flaw in FUXA, an industrial automation software. While the MLflow SSRF vulnerability (CVE-2026-64849) is actively being exploited to steal cloud credentials, the FUXA vulnerability is currently only being scanned for, with no RCE payloads observed yet.
CISA has officially added CVE-2026-64849, an MLflow Server-Side Request Forgery (SSRF) vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog. This inclusion is based on confirmed evidence of active exploitation in the wild. Federal agencies are now mandated by Binding Operational Directive 26-04 to prioritize patching this vulnerability on any publicly exposed assets.
The US Cybersecurity and Infrastructure Security Agency (CISA) has officially added CVE-2026-64849 to its Known Exploited Vulnerabilities (KEV) catalog. This inclusion mandates federal agencies to patch the MLflow SSRF vulnerability within two weeks, aligning with Binding Operational Directive 26-04, underscoring the severity and active exploitation of this flaw.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially added this MLflow vulnerability (CVE-2026-64849) to its Known Exploited Vulnerabilities (KEV) Catalog, mandating federal agencies to patch it by September 2nd. While the initial advisory from MLflow researchers did not confirm real-world breaches, CISA's inclusion and reports from security firms like WatchTowr indicate active exploitation in the wild, with honeypots detecting widespread scanning for exposed MLflow servers shortly after the CVE was assigned.