Security Affairspublished Aug 20, 08:58 UTC (26d ago)ingested Sep 10, 06:12 UTC@securityaffairs

U.S. CISA adds a MLflow flaw to its Known Exploited Vulnerabilities catalog

highExploit / PoC exploited in the wildimportance 85CVE-2026-64849

AI summary · glm-5.3-flash

CISA added actively exploited MLflow SSRF flaw CVE-2026-64849 (CVSS 9.3) to its KEV catalog; attackers are stealing cloud credentials from exposed instances.

CISA added CVE-2026-64849, a critical unauthenticated server-side request forgery in MLflow, to its Known Exploited Vulnerabilities catalog. The flaw affects MLflow versions before 3.15.0 and allows unauthenticated attackers to reach internal services including cloud metadata endpoints, exposing temporary cloud credentials. watchTowr observed in-the-wild exploitation exfiltrating credentials and secrets, plus widespread scanning of exposed MLflow instances within hours of the CVE's assignment on August 17, 2026. MLflow is an open-source platform for managing the machine learning and AI development lifecycle with over 60 million monthly downloads.

CISA KEV addition confirms active exploitation of the unauthenticated SSRF flaw
Attackers target cloud metadata services to steal credentials and secrets
watchTowr honeypots recorded indiscriminate scanning hours after CVE assignment on August 17, 2026
MLflow versions before 3.15.0 are affected; platform has 60 million+ monthly downloads

Read the original

VendorsCISA Progress watchTowr

ProductsMLflow

Victimsexposed MLflow instances

OrganizationsSecurity Affairs

CountriesUSA

ATT&CK T1190 Exploit Public-Facing Application T1552.005 Cloud Instance Metadata API T1528 Steal Application Access Token

Tagsmlflow cisa kev ssrf cve-2026-64849 cloud-credentials exploitation

Vulnerabilities mentionedAll →

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-64849	Unauthenticated SSRF in MLflow Exposes Cloud Credentials and Secrets MLflow versions prior to 3.15.0 contain a server-side request forgery flaw (CWE-918) in the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint. The webhook URL is validated only for the original request, but delivery follows redirects and re-resolves the hostname without pinning the validated address, letting an attacker redirect server-side requests to internal network services or cloud instance metadata endpoints. Because the endpoint returns response_status and response_body, attackers can read internal service responses and, per public reporting, steal cloud credentials and secrets from metadata services. Any self-hosted MLflow deployment is affected, with internet-exposed servers at the highest risk. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-08-19, and headlines report active attacks stealing cloud credentials; EPSS puts 30-day exploitation probability at 16.4% (97th percentile). Do: Upgrade to MLflow 3.15.0 or later immediately, prioritizing any MLflow server reachable from the internet. Until patched, restrict network access to MLflow (especially the /api/2.0/mlflow/webhooks/{id}/test endpoint), place it behind authentication or a reverse proxy, and review webhook logs for unexpected test requests and cloud metadata endpoint access; rotate cloud credentials and secrets if compromise indicators are found. Federal agencies must apply vendor mitigations in accordance with CISA BOD 26-04 guidance or discontinue use if mitigations are unavailable.	9.3	16%	KEV PoC ×3	lfprojects MLflow All versions prior to 3.15.0 (fixed in 3.15.0)	moderatelikely thousands of internet-exposed MLflow servers, from a substantially larger installed base (estimate)	29d ago

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-64849

Unauthenticated SSRF in MLflow Exposes Cloud Credentials and Secrets

MLflow versions prior to 3.15.0 contain a server-side request forgery flaw (CWE-918) in the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint. The webhook URL is validated only for the original request, but delivery follows redirects and re-resolves the hostname without pinning the validated address, letting an attacker redirect server-side requests to internal network services or cloud instance metadata endpoints. Because the endpoint returns response_status and response_body, attackers can read internal service responses and, per public reporting, steal cloud credentials and secrets from metadata services. Any self-hosted MLflow deployment is affected, with internet-exposed servers at the highest risk. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-08-19, and headlines report active attacks stealing cloud credentials; EPSS puts 30-day exploitation probability at 16.4% (97th percentile).

Do: Upgrade to MLflow 3.15.0 or later immediately, prioritizing any MLflow server reachable from the internet. Until patched, restrict network access to MLflow (especially the /api/2.0/mlflow/webhooks/{id}/test endpoint), place it behind authentication or a reverse proxy, and review webhook logs for unexpected test requests and cloud metadata endpoint access; rotate cloud credentials and secrets if compromise indicators are found. Federal agencies must apply vendor mitigations in accordance with CISA BOD 26-04 guidance or discontinue use if mitigations are unavailable.

9.3

16%

KEV PoC ×3

lfprojects MLflow All versions prior to 3.15.0 (fixed in 3.15.0)

moderatelikely thousands of internet-exposed MLflow servers, from a substantially larger installed base (estimate)

29d ago

Full article244 words · extracted from securityaffairs.com · click to collapse

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds an MLflow vulnerability to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Progress LoadMaster vulnerability, tracked as CVE-2026-64849 (CVSS score of 9.3), to its Known Exploited Vulnerabilities (KEV) catalog.

CVE-2026-64849 is a critical server-side request forgery (SSRF) vulnerability in MLflow, a platform for managing machine-learning workflows. The issue affects MLflow versions before 3.15.0 and a remote attacker can exploit the issue without authentication. The vulnerability allows attackers to make requests from an exposed MLflow server to internal services, including cloud metadata endpoints, potentially exposing temporary cloud credentials.

Attackers are actively exploiting CVE-2026-64849 to access cloud metadata services and steal credentials and secrets. Cybersecurity firm watchTowr also observed widespread scanning for exposed MLflow instances just hours after the CVE was assigned on August 17, 2026.

“watchTowr Intel is observing in-the-wild exploitation of a critical unauthenticated Server-Side Request Forgery vulnerability in MLflow (CVE-2026-64849), the open-source platform for managing the machine learning and AI development lifecycle, with over 60 million monthly downloads.” watchTowr said in a post on LinkedIn. “Attackers are exploiting the vulnerability to reach cloud metadata services directly, and exfiltrating cloud credentials and secrets. Within hours of the CVE being assigned, Attacker Eye, our global honeypot network, detected attackers indiscriminately scanning for exposed MLflow systems online, capturing attempts against cloud-hosted instances.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/197558/hacking/u-s-cisa-adds-a-mlflow-flaw-to-its-known-exploited-vulnerabilities-catalog.html