U.S. CISA adds a MLflow flaw to its Known Exploited Vulnerabilities catalog
CISA added actively exploited MLflow SSRF flaw CVE-2026-64849 (CVSS 9.3) to its KEV catalog; attackers are stealing cloud credentials from exposed instances.
CISA added CVE-2026-64849, a critical unauthenticated server-side request forgery in MLflow, to its Known Exploited Vulnerabilities catalog. The flaw affects MLflow versions before 3.15.0 and allows unauthenticated attackers to reach internal services including cloud metadata endpoints, exposing temporary cloud credentials. watchTowr observed in-the-wild exploitation exfiltrating credentials and secrets, plus widespread scanning of exposed MLflow instances within hours of the CVE's assignment on August 17, 2026. MLflow is an open-source platform for managing the machine learning and AI development lifecycle with over 60 million monthly downloads.
- CISA KEV addition confirms active exploitation of the unauthenticated SSRF flaw
- Attackers target cloud metadata services to steal credentials and secrets
- watchTowr honeypots recorded indiscriminate scanning hours after CVE assignment on August 17, 2026
- MLflow versions before 3.15.0 are affected; platform has 60 million+ monthly downloads
- CVEs
- CVE-2026-64849
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1552.005 Cloud Instance Metadata APIT1528 Steal Application Access Token
- Products
- MLflow
- Victims
- exposed MLflow instances
- Organizations
- Security Affairs
- Countries
- USA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-64849 | Unauthenticated SSRF in MLflow Exposes Cloud Credentials and Secrets | 9.3 | 10% | KEVPoC ×5 | KEV |
From the original article
1 min read at securityaffairs.com
U. S. Cybersecurity and Infrastructure Security Agency (CISA) adds an MLflow vulnerability to its Known Exploited Vulnerabilities catalog.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.