Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets
CVE-2026-64849 (CVSS 9.3): Unauthenticated SSRF in MLflow model-registry webhooks allows attackers to proxy requests through the server to internal cloud metadata endpoints, exfiltrating credentials and secrets; affects versions below 3.15.0 CVE-2026-25895 (CVSS 9.5): Missing authentication combined with path traversal in FUXA SCADA/HMI software enables unauthenticated remote attackers to write arbitrary files and achieve remote code execution; affects versions 1.2.9 and below Both vulnerabiliti
Analysis
TL;DR
- CVE-2026-64849 (CVSS 9.3): Unauthenticated SSRF in MLflow model-registry webhooks allows attackers to proxy requests through the server to internal cloud metadata endpoints, exfiltrating credentials and secrets; affects versions below 3.15.0
- CVE-2026-25895 (CVSS 9.5): Missing authentication combined with path traversal in FUXA SCADA/HMI software enables unauthenticated remote attackers to write arbitrary files and achieve remote code execution; affects versions 1.2.9 and below
- Both vulnerabilities are under active exploitation in the wild, with malicious scanning detected within hours of CVE assignment (August 17–18, 2026)
- The MLflow SSRF bypasses prior security fixes due to how the system handles HTTP redirects, targeting cloud-hosted instances to extract secrets from well-known internal IP addresses
- Approximately 60 FUXA installations are exposed to the public internet, with a single IP observed broadly scanning for vulnerable instances
Why It Matters
This highlights the critical intersection of AI infrastructure security and operational technology risk, as widely deployed open-source tools like MLflow and FUXA are being rapidly exploited in the wild. AI practitioners running MLflow on cloud environments face immediate credential theft risks, while OT/industrial sectors relying on FUXA face potential remote code execution — demonstrating how vulnerabilities in seemingly niche tools can cascade into severe cloud and industrial compromises.
Technical Details
- CVE-2026-64849 (MLflow SSRF): The vulnerability resides in MLflow's model-registry webhook handler, which fails to properly restrict outbound HTTP requests. Attackers can supply arbitrary URLs that the server proxies, enabling access to cloud metadata services (e.g., AWS EC2, GCP, Azure instance metadata endpoints at 169.254.169.254). The flaw bypasses prior redirect-handling fixes, indicating a deeper architectural issue in request validation logic.
- CVE-2026-25895 (FUXA): A dual-flaw combining missing authentication on a critical file-write endpoint and a path traversal vulnerability. Attackers can overwrite server-side JavaScript files (e.g., main.js) with arbitrary content, leading to remote code execution. The attack chain requires no credentials and can be executed over the public internet.
- Active exploitation evidence: watchTowr's global honeypot telemetry confirmed attackers targeting cloud-hosted MLflow instances for credential exfiltration. VulnCheck observed a single IP conducting broad internet scans for FUXA instances starting August 18, 2026, with attempts to overwrite main.js using junk data payloads.
- Historical context: FUXA has a pattern of active exploitation — CVE-2026-25939 and CVE-2023-33831 have also seen sustained attack activity, with the latter dating back to November 2025.
Industry Insight
- Organizations running MLflow must urgently patch to version 3.15.0 or later, audit access logs for anomalous webhook requests, and rotate any cloud credentials that may have been exposed — treat this as an active breach scenario, not a theoretical risk.
- OT and industrial automation teams should immediately isolate FUXA instances from the public internet; with only ~60 exposed installations and active scanning underway, the window for preventive action is narrow and closing.
- The rapid exploitation timeline (hours from CVE publication) underscores the need for automated vulnerability management and proactive threat intelligence integration — waiting for vendor patches is no longer a viable strategy for exposed internet-facing services.
Disclaimer: The above content is generated by AI and is for reference only.