Critical MLflow SSRF Vulnerability Actively Exploited for Cloud Credential Theft

Threat actors are actively exploiting a critical, unauthenticated server-side request forgery (SSRF) vulnerability in MLflow, the popular open-source platform widely used by data engineering and machine learning teams to track experiments, package code, and deploy models. Tracked as CVE-2026-64849 with a critical CVSS 3.1 score of 9.3, the flaw impacts all MLflow versions prior to 3.15.0. Threat monitoring by watchTowr Intel through its global Attacker Eye honeypot sensor network identified adversaries targeting internet-exposed MLflow instances within hours of public disclosure to harvest cloud credentials and sensitive deployment tokens.

A default MLflow Tracking Server initialized via mlflow server runs without mandatory authentication and relies on a local SQLite backend, exposing the model-registry webhooks API to untrusted network traffic. The primary vulnerability path resides in an unauthenticated POST request to /api/2.0/mlflow/webhooks/{id}/test. Rather than simply firing the designated webhook, the endpoint reflects the full upstream HTTP status code and response body back to the requester, converting a standard blind request-forgery into a high-impact, full-read primitive.

While MLflow previously introduced the _validate_webhook_url() helper in version 3.10.0 to reject private and cloud metadata addresses, the validation only evaluates the initial destination. The underlying delivery handler in mlflow/webhooks/delivery.py continues to follow HTTP redirects without re-validating the secondary address. An attacker can configure a public endpoint that passes initial checks and returns an HTTP 302 redirect pointing toward link-local cloud metadata services or internal loopback interfaces. Furthermore, because the hostname resolves again following the initial allowlist verification, the interface remains susceptible to DNS-rebinding attacks. Similar architectural flaws have surfaced in other SSRF bypass vulnerabilities across machine learning frameworks.

According to watchTowr Cyber Intelligence, automated scanners began hitting cloud-hosted MLflow endpoints almost immediately after the vulnerability received its official identifier. On major cloud providers including Amazon Web Services, Microsoft Azure, and Google Cloud Platform, the reflected response allows attackers to extract temporary IAM role credentials, OAuth tokens, and environment configurations from the link-local metadata address at http://169.254.169.254/. Beyond cloud provider metadata, the exploit can query internal microservices and loopback administrative consoles that implicitly trust the host environment.

The velocity of these intrusions mirrors broader trends where automated scanners rapidly weaponize zero-click software vulnerabilities against exposed enterprise infrastructure. Maintainers have resolved the redirect and DNS-rebinding exposure in MLflow 3.15.0 via pull request 24258. Organizations operating internet-facing or shared Tracking Servers must immediately upgrade to version 3.15.0 or later.

Because applying patches does not revoke credentials that may have already been exfiltrated, security teams must audit access logs for requests directed to /webhooks/*/test, rotate all cloud IAM keys and API secrets assigned to host instances, and enforce network egress filtering to restrict unauthorized communication with link-local metadata addresses. Executing rigorous emergency patch management and placing MLflow behind identity-aware proxies ensures that internal tracking portals remain isolated from public scanning networks.

This new report details a second critical vulnerability affecting MLflow, CVE-2026-25895, a path traversal flaw in FUXA, an industrial automation software. While the MLflow SSRF vulnerability (CVE-2026-64849) is actively being exploited to steal cloud credentials, the FUXA vulnerability is currently only being scanned for, with no RCE payloads observed yet.