exposed MLflow instances

Mentions · 7d0
Mentions · 30d0
All mentions1
First seenAug 20, 2026
Last mentionedAug 20, 2026

Timeline

1 articles · newest first

U.S. CISA adds a MLflow flaw to its Known Exploited Vulnerabilities catalog

CISA added actively exploited MLflow SSRF flaw CVE-2026-64849 (CVSS 9.3) to its KEV catalog; attackers are stealing cloud credentials from exposed instances.

Security AffairsAug 20, 08:58 UTC · Aug 20, 2026Exploit / PoCExploitedCVE-2026-648492 · 2 reads

Related CVEs

by mentions

CVE-2026-6484910%9.3
Unauthenticated SSRF in MLflow Exposes Cloud Credentials and Secrets
published Aug 17, 2026lfprojects MLflowKEVPoC ×5

Appears with

Security Affairsorganization · 1
watchTowrvendor · 1
CISAvendor · 1
Progressvendor · 1
MLflowproduct · 1

Entities are extracted by the model from each article. First seen Aug 20, 2026, last mentioned Aug 20, 2026. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.