AI Security AI安全 1d ago Updated 1d ago 更新于 1天前 50

MLflow Vulnerability Exploited for Cloud Credential Theft MLflow漏洞被利用进行云凭据窃取

MLflow vulnerability CVE-2026-64849 (CVSS 9.3) is an unauthenticated SSRF allowing attackers to reach internal endpoints and cloud metadata services The flaw exists because the model-registry webhooks API is exposed without authentication on the default MLflow Tracking Server All MLflow versions before 3.15.0 are affected, with in-the-wild exploitation beginning within hours of CVE assignment CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog, requiring federal agenc MLflow存在严重SSRF漏洞(CVE-2026-64849,CVSS 9.3),未认证攻击者可窃取云凭据和密钥 漏洞源于默认MLflow Tracking Server暴露了无认证的model-registry webhooks API 攻击在CVE分配后数小时内即开始,针对云托管实例 所有MLflow 3.15.0之前版本受影响,CISA已将其列入已知被利用漏洞目录

72
Hot 热度
65
Quality 质量
75
Impact 影响力

Analysis 深度分析

TL;DR

  • MLflow vulnerability CVE-2026-64849 (CVSS 9.3) is an unauthenticated SSRF allowing attackers to reach internal endpoints and cloud metadata services
  • The flaw exists because the model-registry webhooks API is exposed without authentication on the default MLflow Tracking Server
  • All MLflow versions before 3.15.0 are affected, with in-the-wild exploitation beginning within hours of CVE assignment
  • CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog, requiring federal agencies to patch within two weeks
  • Attackers are actively exfiltrating cloud credentials and secrets from cloud-hosted MLflow instances

Why It Matters

This vulnerability directly impacts AI practitioners and organizations deploying MLflow in production, as it can lead to credential theft and unauthorized access to cloud infrastructure. The rapid exploitation timeline underscores the importance of immediate patching for any exposed MLflow instances, especially in cloud environments where metadata services are commonly targeted.

Technical Details

  • CVE-2026-64849: Unauthenticated server-side request forgery (SSRF) with a CVSS score of 9.3, affecting all MLflow versions prior to 3.15.0
  • Root Cause: The default MLflow Tracking Server exposes the model-registry webhooks API without authentication, and an SSRF protection mechanism introduced in version 3.10.0 can be bypassed
  • Attack Vector: One exposed endpoint returns the upstream response status and body to the caller, enabling attackers to query cloud metadata services (e.g., AWS EC2 instance metadata) and extract credentials and secrets
  • MLflow Scale: The platform has over 27,000 GitHub stars and more than 60 million monthly downloads, amplifying the potential blast radius
  • Mitigation: Upgrade to MLflow 3.15.0 or later, review audit logs for signs of compromise, and assess whether sensitive credentials have been exposed

Industry Insight

  • Organizations running MLflow in cloud environments should treat this as a critical emergency, prioritizing immediate patching of any externally exposed instances given the active exploitation in the wild
  • The rapid exploitation timeline (within hours of CVE assignment) reinforces the need for automated vulnerability management and continuous monitoring of attack surface exposure for widely adopted open-source AI tools
  • AI engineering platforms with high download counts and broad adoption represent high-value targets; security teams should implement network segmentation and restrict outbound access from MLflow servers to cloud metadata endpoints as a defense-in-depth measure

TL;DR

  • MLflow存在严重SSRF漏洞(CVE-2026-64849,CVSS 9.3),未认证攻击者可窃取云凭据和密钥
  • 漏洞源于默认MLflow Tracking Server暴露了无认证的model-registry webhooks API
  • 攻击在CVE分配后数小时内即开始,针对云托管实例
  • 所有MLflow 3.15.0之前版本受影响,CISA已将其列入已知被利用漏洞目录

为什么值得看

MLflow作为拥有27,000+ GitHub星标和6000万+月下载量的主流AI工程平台,其安全漏洞直接影响大量AI/ML生产环境。该漏洞可被利用窃取云凭据,对AI基础设施安全构成严重威胁。

技术解析

  • 漏洞类型:未认证服务器端请求伪造(SSRF),CVSS评分9.3
  • 根本原因:默认MLflow Tracking Server(mlflow server)暴露了model-registry webhooks API,且未启用认证机制
  • 绕过机制:版本3.10.0引入的SSRF防护可被绕过,暴露的端点会返回上游响应状态和响应体
  • 影响范围:所有MLflow 3.15.0之前版本
  • 攻击方式:攻击者直接访问云元数据服务,窃取云凭据和密钥

行业启示

  • AI基础设施安全需要与核心功能同等重视,开源AI工具的安全审计应成为DevOps流程的强制环节
  • 云原生AI平台的默认配置安全策略需要重新评估,无认证暴露的API端点应被视为高风险
  • 快速响应机制至关重要,此类高危漏洞从披露到被利用的时间窗口极短,组织需要建立自动化漏洞检测和补丁管理流程

Disclaimer: The above content is generated by AI and is for reference only. 免责声明:以上内容由 AI 生成,仅供参考。

Security 安全 Open Source 开源 Deployment 部署