Active Exploitation of Critical MLflow SSRF Vulnerability (CVE-2026-64849) Targets Cloud Environments
Threat actors are actively exploiting CVE-2026-64849, an unauthenticated server-side request forgery (SSRF) flaw in MLflow, a widely used machine learning platform. The vulnerability affects all versions prior to 3.15.0 and was disclosed on August 18, 2026, with exploitation attempts detected within hours via watchTowr Intel’s Attacker Eye honeypot network.
The flaw allows attackers to manipulate MLflow servers into making unauthorized requests, potentially accessing sensitive cloud resources such as credentials, API tokens, and application secrets. In cloud environments, SSRF vulnerabilities are particularly dangerous, as compromised servers may interact with internal-only services, including cloud metadata endpoints, which can expose temporary identity credentials.
Successful exploitation could grant attackers access to cloud access keys, instance identity tokens, service account credentials, environment variables, or secrets stored in reachable internal systems. Given MLflow’s proximity to high-value assets such as model-training data, experiment artifacts, CI/CD pipelines, and production inference systems a breach could enable lateral movement and further compromise.
Security teams are advised to prioritize upgrading to MLflow 3.15.0 or later, particularly for internet-facing instances with cloud identity permissions. Logs should be reviewed for unusual outbound requests, including connections to cloud metadata services, private IP ranges, or unexpected access to internal APIs. If exploitation is suspected, organizations should revoke and rotate potentially exposed credentials, assess access policies for excessive permissions, and investigate cloud audit logs for anomalous activity.
Source: https://cyberpress.org/hackers-exploit-mlflow-ssrf-flaw/
MLflow TPRM report: https://www.rankiteo.com/company/mlflow-org
"id": "mlf1787063064",
"linkid": "mlflow-org",
"type": "Vulnerability",
"date": "8/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': 'Technology, Cloud Services, Data Science',
'type': 'Machine Learning Platform'}],
'attack_vector': 'Unauthenticated remote exploitation',
'data_breach': {'sensitivity_of_data': 'High',
'type_of_data_compromised': 'Credentials, API tokens, '
'application secrets, cloud '
'access keys, instance identity '
'tokens, service account '
'credentials, environment '
'variables'},
'date_detected': '2026-08-18',
'date_publicly_disclosed': '2026-08-18',
'description': 'Threat actors are actively exploiting CVE-2026-64849, an '
'unauthenticated server-side request forgery (SSRF) flaw in '
'MLflow, a widely used machine learning platform. The '
'vulnerability affects all versions prior to 3.15.0 and allows '
'attackers to manipulate MLflow servers into making '
'unauthorized requests, potentially accessing sensitive cloud '
'resources such as credentials, API tokens, and application '
'secrets. Successful exploitation could grant attackers access '
'to cloud access keys, instance identity tokens, service '
'account credentials, environment variables, or secrets stored '
'in reachable internal systems, enabling lateral movement and '
'further compromise.',
'impact': {'data_compromised': 'Credentials, API tokens, application secrets, '
'cloud access keys, instance identity tokens, '
'service account credentials, environment '
'variables',
'identity_theft_risk': 'High (if personally identifiable '
'information is exposed)',
'operational_impact': 'Potential lateral movement, unauthorized '
'access to high-value assets (model-training '
'data, experiment artifacts, CI/CD '
'pipelines, production inference systems)',
'systems_affected': 'MLflow servers (versions prior to 3.15.0), '
'cloud metadata endpoints, internal-only '
'services'},
'initial_access_broker': {'high_value_targets': 'Model-training data, '
'experiment artifacts, CI/CD '
'pipelines, production '
'inference systems'},
'post_incident_analysis': {'corrective_actions': 'Upgrade to MLflow 3.15.0 or '
'later, revoke and rotate '
'exposed credentials, review '
'and restrict cloud identity '
'permissions',
'root_causes': 'Unauthenticated SSRF vulnerability '
'in MLflow (CVE-2026-64849)'},
'recommendations': 'Prioritize upgrading to MLflow 3.15.0 or later, '
'particularly for internet-facing instances with cloud '
'identity permissions. Revoke and rotate potentially '
'exposed credentials. Assess access policies for excessive '
'permissions. Investigate cloud audit logs for anomalous '
'activity.',
'references': [{'source': 'watchTowr Intel’s Attacker Eye honeypot network'}],
'response': {'containment_measures': 'Upgrade to MLflow 3.15.0 or later, '
'revoke and rotate potentially exposed '
'credentials',
'enhanced_monitoring': 'Review logs for connections to cloud '
'metadata services, private IP ranges, or '
'unexpected access to internal APIs',
'remediation_measures': 'Review logs for unusual outbound '
'requests, assess access policies for '
'excessive permissions, investigate '
'cloud audit logs for anomalous '
'activity'},
'title': 'Active Exploitation of Critical MLflow SSRF Vulnerability '
'(CVE-2026-64849) Targets Cloud Environments',
'type': 'Server-Side Request Forgery (SSRF)',
'vulnerability_exploited': 'CVE-2026-64849'}