MLflow Vulnerability Exploited for Cloud Credential Theft
MLflow vulnerability CVE-2026-64849 (CVSS 9.3) is an unauthenticated SSRF allowing attackers to reach internal endpoints and cloud metadata services The flaw exists because the model-registry webhooks API is exposed without authentication on the default MLflow Tracking Server All MLflow versions before 3.15.0 are affected, with in-the-wild exploitation beginning within hours of CVE assignment CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog, requiring federal agenc
Analysis
TL;DR
- MLflow vulnerability CVE-2026-64849 (CVSS 9.3) is an unauthenticated SSRF allowing attackers to reach internal endpoints and cloud metadata services
- The flaw exists because the model-registry webhooks API is exposed without authentication on the default MLflow Tracking Server
- All MLflow versions before 3.15.0 are affected, with in-the-wild exploitation beginning within hours of CVE assignment
- CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog, requiring federal agencies to patch within two weeks
- Attackers are actively exfiltrating cloud credentials and secrets from cloud-hosted MLflow instances
Why It Matters
This vulnerability directly impacts AI practitioners and organizations deploying MLflow in production, as it can lead to credential theft and unauthorized access to cloud infrastructure. The rapid exploitation timeline underscores the importance of immediate patching for any exposed MLflow instances, especially in cloud environments where metadata services are commonly targeted.
Technical Details
- CVE-2026-64849: Unauthenticated server-side request forgery (SSRF) with a CVSS score of 9.3, affecting all MLflow versions prior to 3.15.0
- Root Cause: The default MLflow Tracking Server exposes the model-registry webhooks API without authentication, and an SSRF protection mechanism introduced in version 3.10.0 can be bypassed
- Attack Vector: One exposed endpoint returns the upstream response status and body to the caller, enabling attackers to query cloud metadata services (e.g., AWS EC2 instance metadata) and extract credentials and secrets
- MLflow Scale: The platform has over 27,000 GitHub stars and more than 60 million monthly downloads, amplifying the potential blast radius
- Mitigation: Upgrade to MLflow 3.15.0 or later, review audit logs for signs of compromise, and assess whether sensitive credentials have been exposed
Industry Insight
- Organizations running MLflow in cloud environments should treat this as a critical emergency, prioritizing immediate patching of any externally exposed instances given the active exploitation in the wild
- The rapid exploitation timeline (within hours of CVE assignment) reinforces the need for automated vulnerability management and continuous monitoring of attack surface exposure for widely adopted open-source AI tools
- AI engineering platforms with high download counts and broad adoption represent high-value targets; security teams should implement network segmentation and restrict outbound access from MLflow servers to cloud metadata endpoints as a defense-in-depth measure
Disclaimer: The above content is generated by AI and is for reference only.