Product

FUXA

0 mentions in 7 days · 1 in 30 days · 1 total · first seen Aug 20, 2026 · last 27d ago

Timeline1 articles

Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets

Attackers exploit MLflow SSRF CVE-2026-64849 (CVSS 9.3) to steal cloud credentials; CISA added it to KEV; FUXA flaw CVE-2026-25895 is being scanned.

watchTowr observed exploitation of MLflow CVE-2026-64849, an unauthenticated SSRF (CVSS 9.3) affecting versions below 3.15.0, within hours of CVE assignment on August 17, 2026, with attackers abusing model-registry webhooks to reach cloud metadata endpoints and exfiltrate credentials and secrets. CISA added the flaw to its Known Exploited Vulnerabilities catalog on August 19, 2026, with a September 2 patch deadline for federal civilian agencies. VulnCheck reported scanning of FUXA CVE-2026-25895 (missing authentication plus path traversal, CVSS 9.5, versions through 1.2.9) beginning August 18; about 60 FUXA instances are exposed and no RCE payloads have been dropped yet.

The Hacker NewsAug 20, 05:48 UTC · 27d agoExploit / PoC in the wildCVE-2026-64849 CVE-2026-25895 CVE-2026-25939+1 CVEs

Related CVEsby mentions

CVE-2026-648499.316%
Unauthenticated SSRF in MLflow Exposes Cloud Credentials and Secrets
MLflow versions prior to 3.15.0 contain a server-side request forgery flaw (CWE-918) in the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint. The webhook URL is validated only for the original request, but delivery follows redirects and re-resolves the hostname without pinning the validated address, letting an attacker redirect server-side requests to internal network services or cloud instance metadata endpoints. Because the endpoint returns response_status and response_body, attackers can read internal service responses and, per public reporting, steal cloud credentials and secrets from metadata services. Any self-hosted MLflow deployment is affected, with internet-exposed servers at the highest risk. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-08-19, and headlines report active attacks stealing cloud credentials; EPSS puts 30-day exploitation probability at 16.4% (97th percentile).
· lfprojects MLflow All versions prior to 3.15.0 (fixed in 3.15.0) KEV PoC ×3moderate
CVE-2023-338319.823%
A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST r
A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request.
· frangoteam fuxa PoC ×2—
CVE-2026-258959.511%
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.
· frangoteam fuxa—
CVE-2026-259399.312%
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through version 1.2.10, an authorization bypass vulnerability in the FUXA allows an unauthenticated, remote attacker to create and modify arbitrary schedulers, exposing connected ICS/SCADA environments to follow-on actions. This has been patched in FUXA version 1.2.11.
· frangoteam fuxa—

Appears with

organization CISA 1 organization VulnCheck 1 organization watchTowr 1 product MLflow 1 vendor CISA 1 vendor VulnCheck 1 vendor watchTowr 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.