GitHub issues used in CI attacks on 61 public repositories
Radware counted 83 payloads, mostly within 43 minutes on September 1, aimed at stealing CI secrets; code changes remain unconfirmed.
68
Product
MLflow
- Mentions · 7d10
- Mentions · 30d11
- All mentions14
- First seenAug 20, 2026
- Last mentioned4d ago
Timeline
14 articles · newest firstUnauthenticated MLflow get-artifacts SSRF leaks data (CVE-2026-118628)
ZDI rates the flaw 8.2; the snippet gives no affected versions, fix, or exploitation status.
52
MLflow Tracking Server missing authorization allows privilege escalation
Authenticated remote attackers can escalate privileges; ZDI scores CVE-2026-118625 at CVSS 6.3.
36
Authenticated MLflow webhook SSRF rated CVSS 6.8 (CVE-2026-64849)
Logged-in attackers can make the server send arbitrary requests; versions and a fix are not given.
38
MLflow Statsmodels load can run code after user action (CVE-2024-37052)
The target must open a malicious page or file; ZDI rates the flaw CVSS 7.8.
50
MLflow AI Gateway SSRF can leak data if authenticated (CVE-2026-71211)
ZDI rates the authenticated flaw 7.7; the snippet does not name versions or a patch.
44
MLflow Tracking Server issues missing authorization allows privilege escalation
Authenticated remote attackers can raise privileges; ZDI rates CVE-2026-118626 at CVSS 5.4, with no fix listed.
34
MLflow pickle evaluation artifact deserialization allows remote code execution
A user must open a malicious page or file; ZDI rates CVE-2026-118623 at CVSS 7.8.
44
MLflow Tracking Server jobs flaw can disclose sensitive information
Authenticated remote attackers can read sensitive data; ZDI rates CVE-2026-118624 at CVSS 5.4.
32
MLflow SHAP load_explainer bug allows RCE (CVE-2026-118627)
ZDI rates the deserialization flaw 7.8 and says the victim must open a malicious page or file.
54
New Agentic AI Red Team Checklist Adds 222 Tests Across 20 Attack Categories
Researcher Ravi Rajput released 222 agentic-AI red-team tests across 20 categories, mapped to OWASP and MITRE ATLAS.
52
VU#369093: MLflow dspy and statsmodels flavors bypass pickle deserialization control
CERT/CC warns MLflow's dspy and statsmodels flavors bypass the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control, enabling remote code execution.
50
U.S. CISA adds a MLflow flaw to its Known Exploited Vulnerabilities catalog
CISA added actively exploited MLflow SSRF flaw CVE-2026-64849 (CVSS 9.3) to its KEV catalog; attackers are stealing cloud credentials from exposed instances.
85
Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets
Attackers exploit MLflow SSRF CVE-2026-64849 (CVSS 9.3) to steal cloud credentials; CISA added it to KEV; FUXA flaw CVE-2026-25895 is being scanned.
74
Related CVEs
by mentions- CVE-2026-6484910%9.3Unauthenticated SSRF in MLflow Exposes Cloud Credentials and Secrets
- CVE-2023-3383126%9.8A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST…
- CVE-2026-2589511%9.5FUXA: A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations…
- CVE-2026-2593912%9.3FUXA: An authorization bypass vulnerability in the FUXA allows an unauthenticated, remote attacker to create and modify arbitrary…
- CVE-2024-37052<1%8.8Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn…
Appears with
- Zero Day Initiativeorganization · 9
- MLflow Tracking Serverproduct · 3
- watchTowrvendor · 2
- CISAvendor · 2
- GitHubproduct · 1
- Trivyproduct · 1
- VulnCheckorganization · 1
- VulnCheckvendor · 1
- exposed MLflow instancesvictim · 1
- watchTowrorganization · 1
- OWASPorganization · 1
- Security Affairsorganization · 1
- MLfloworganization · 1
- CERT/CCorganization · 1
- MLflow AI Gatewayproduct · 1
- Radwareorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.