Critical MLflow CVE Enables SSRF Cloud Credential Theft

CISA has added a critical MLflow vulnerability to its Known Exploited Vulnerabilities catalog after confirming active exploitation in the wild. The flaw, tracked as CVE-2026-64849, is a DNS-rebinding server-side request forgery vulnerability that allows unauthenticated attackers to steal cloud credentials from internal services on unpatched MLflow tracking servers.

MLflow is an open-source AI engineering platform backed by the Linux Foundation with over 30 million monthly downloads. Consequently, thousands of organizations use it to debug, evaluate, and monitor AI applications. The platform’s tracking server exposes a model-registry webhooks API without authentication by default. Therefore, any attacker who can reach the server can force it to issue HTTP requests to arbitrary internal endpoints and read the responses.

What Happened: CVE-2026-64849 MLflow SSRF Actively Exploited in Cloud Credential Theft

CVE-2026-64849 is a DNS-rebinding server-side request forgery flaw in MLflow’s outbound webhook delivery. It was patched in version 3.15.0 and disclosed approximately three weeks ago. However, CISA confirmed on August 19, 2026, that threat actors are now actively exploiting the vulnerability to reach cloud metadata services and exfiltrate credentials.

On August 19, CISA added CVE-2026-64849 to its Known Exploited Vulnerabilities catalog and ordered U.S. Federal Civilian Executive Branch agencies to secure their MLflow instances within two weeks. Moreover, cybersecurity firm watchTowr reported that attackers began scanning for MLflow systems within hours of the CVE assignment. The scans target cloud metadata services such as AWS IMDS directly.

This vulnerability is the second MLflow flaw to reach CISA’s KEV catalog in recent months. In July 2026, CVE-2026-55040 was added for active exploitation. Therefore, organizations running MLflow should treat this platform as a high-priority patch target.

Technical Details of the MLflow CVE-2026-64849 Vulnerability

The vulnerability resides in the MLflow Tracking Server’s model-registry webhooks API. By default, the tracking server runs without authentication and uses a SQLite backend. The synchronous POST /api/2.0/mlflow/webhooks/{id}/test endpoint is exposed unauthenticated. Consequently, an attacker can force the server to issue HTTP requests to internal or loopback addresses.

Successful exploitation enables several attack outcomes:

• Cloud credential theft: Attackers can reach AWS Identity and Access Management metadata endpoints to steal IAM credentials.
• Internal service scanning: The server can be used as a proxy to enumerate internal-only admin services behind the network boundary.
• Port and host reconnaissance: Attackers can probe internal infrastructure for additional targets.

The attack complexity is low. No authentication is required. Furthermore, the attacker only needs network access to the tracking server. The vulnerability can be automated for large-scale scanning.

Attack Mechanics: DNS Rebinding and Webhook Abuse

The attack leverages the webhook test endpoint, which returns the upstream response status and body to the caller. An attacker registers a webhook pointing to an internal address, then triggers the test endpoint. The MLflow server issues the request and returns the result to the attacker. Because the server trusts the webhook URL, it follows redirects to internal services.

DNS rebinding is particularly effective here. The attacker controls a domain whose DNS record resolves to an external address initially, then switches to an internal address after the browser or server has cached the result. Consequently, the MLflow server issues a request to an internal service it would normally refuse.

Business and Operational Impact

The impact of CVE-2026-64849 is severe for organizations running MLflow on cloud instances or internal networks with access to sensitive services.

• Cloud account compromise: Stolen AWS IAM credentials can grant attackers full control of cloud resources, leading to data exfiltration and lateral movement.
• AI pipeline disruption: Compromised MLflow instances can be used to poison model artifacts or steal proprietary training data.
• Regulatory exposure: Organizations subject to HIPAA, PCI-DSS, or GDPR face compliance violations if credentials are stolen and used to access protected data.
• Supply-chain risk: MLflow is a dependency for many AI frameworks. Compromise at the model-registry level can propagate downstream to applications that consume registered models.
• Federal mandate: CISA Binding Operational Directive 26-04 requires U.S. government agencies to patch within two weeks of KEV listing.

Moreover, the 30 million monthly downloads figure means the attack surface is massive. Not all of those deployments expose the tracking server publicly. However, even internally exposed instances on flat networks are at risk if an attacker gains initial foothold elsewhere.

Mitigation and Recommendations

Defenders should act immediately to patch, detect, and harden MLflow deployments.

Immediate Actions for Defenders

1. Upgrade to MLflow 3.15.0 or later. This release patches the DNS-rebinding SSRF flaw in the webhook delivery mechanism.
2. Enable authentication on the tracking server. Run mlflow server with authentication and restrict access to authorized users.
3. Review audit logs for exploitation signs. Check MLflow tracking server logs for suspicious webhook registrations and test endpoint calls.
4. Rotate cloud credentials on potentially exposed instances. If the tracking server was internet-facing, assume credentials may have been stolen and rotate them.
5. Restrict network access to the tracking server. Place MLflow behind a VPN or within a private subnet. Do not expose it to the public internet without strong authentication.
6. Monitor for cloud metadata service access. Alert on any requests to 169.254.169.254 or equivalent metadata endpoints from MLflow server hosts.
7. Disable webhooks if not required. If the model-registry webhook feature is unused, disable it to eliminate the attack surface.
8. Apply network segmentation. Isolate MLflow infrastructure from other internal services to limit lateral movement.

Detection and Response Guidance

Security teams should hunt for indicators of compromise in their MLflow environments. Specifically, look for unexpected webhook configurations, outbound requests to internal addresses, and cloud metadata queries originating from MLflow server processes. Furthermore, correlation with endpoint detection and response data can reveal whether stolen credentials were used for subsequent cloud API calls.

Bottom line: CVE-2026-64849 is a critical, actively exploited vulnerability in one of the most widely used AI engineering platforms. Organizations running MLflow must patch immediately, enable authentication, and audit their deployments for signs of compromise. The combination of a large attack surface, low exploitation complexity, and confirmed in-the-wild activity makes this a high-priority remediation item for security teams.

Incident Summary

CVE ID:	CVE-2026-64849
Affected Systems:	MLflow Tracking Server versions prior to 3.15.0 (default config, no auth, SQLite backend)
Disclosure Date:	~August 1, 2026 (security advisory); August 19, 2026 (CISA KEV addition)
Patch Status:	Patched in MLflow 3.15.0; upgrade immediately
Severity:	Critical (unauthenticated SSRF leading to cloud credential theft)
Exploitation Status:	Actively exploited in the wild (CISA KEV confirmed)
Attack Complexity:	Low (no authentication required, network access only)
Impact:	Theft of AWS IAM credentials, internal service access, port scanning
Platform:	Linux (MLflow deployments); cloud and on-premises

References

1. MLflow Security Advisory, “GHSA-7gwp-5pfp-969j: MLflow Tracking Server SSRF via DNS Rebinding,” https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j, accessed August 20, 2026.
2. CISA, “CISA Adds One Known Exploited Vulnerability to Catalog,” August 19, 2026, https://www.cisa.gov/news-events/alerts/2026/08/19/cisa-adds-one-known-exploited-vulnerability-catalog.
3. BleepingComputer, “CISA warns of hackers exploiting critical MLflow vulnerability,” August 20, 2026, https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-critical-mlflow-vulnerability/.
4. watchTowr LinkedIn post, “watchTowr intel: In-the-wild activity observed for MLflow CVE-2026-64849,” August 19, 2026, https://www.linkedin.com/posts/watchtowr_watchtowr-intel-is-observing-in-the-wild-activity-7495481580723838976-qzUA/.
5. NVD, “CVE-2026-64849 Detail,” National Vulnerability Database, https://nvd.nist.gov/vuln/detail/CVE-2026-64849, accessed August 20, 2026.
6. CISA, “Known Exploited Vulnerabilities Catalog,” https://www.cisa.gov/known-exploited-vulnerabilities-catalog, accessed August 20, 2026.