A critical MLflow vulnerability is now under active exploitation, according to the US Cybersecurity and Infrastructure Security Agency. The flaw can let unauthenticated attackers access internal services and cloud metadata on vulnerable MLflow servers.
Tracked as CVE-2026-64849, the issue affects MLflow’s outbound webhook delivery system. Attackers can exploit it through a DNS rebinding server-side request forgery bypass, creating a potential route to sensitive resources that should remain inaccessible from the public internet.
MLflow released version 3.15.0 to fix the issue. Organisations that run exposed or unpatched MLflow instances should treat the update as urgent.
MLflow vulnerability can expose internal services
MLflow is an open-source platform used to build, test, monitor and improve AI applications, including large language model and agent-based projects. It sees more than 30 million monthly downloads and supports thousands of organisations.
The affected setup involves the default MLflow Tracking Server, which can expose the model-registry webhooks API without authentication. A test endpoint can make outbound requests and return the upstream response to the person making the request.
That behaviour allows a remote attacker to send requests to internal services, loopback addresses or cloud metadata endpoints. The attacker can then read the resulting responses through the exposed endpoint.
In practice, this could expose internal administration services, support internal port scanning and reveal cloud instance metadata. It may also allow attackers to obtain cloud credentials, including AWS Identity and Access Management credentials.
CISA adds CVE-2026-64849 to exploited catalog
CISA added CVE-2026-64849 to its Known Exploited Vulnerabilities catalog on August 19. The agency instructed US Federal Civilian Executive Branch agencies to secure affected MLflow systems within two weeks.
The deadline follows Binding Operational Directive 26-04, which requires federal agencies to prioritise serious vulnerabilities that attackers can exploit at scale. The directive also focuses on flaws affecting public-facing systems and those that could give attackers partial or complete control of a targeted environment.
CISA has not shared technical details about the observed attacks. However, cybersecurity firm watchTowr reported that attackers started scanning for MLflow systems within hours of the CVE receiving its identifier.
Attackers target cloud metadata and credentials
Researchers say attackers are using the MLflow vulnerability to reach cloud metadata services directly. From there, they may extract cloud credentials and other secrets.
Cloud metadata endpoints can provide valuable information to applications running on cloud infrastructure. If an attacker gains access to them, they may collect temporary credentials or configuration details that support further intrusion attempts.
The low complexity of the attack increases the risk for exposed servers. An attacker does not need valid MLflow credentials when the vulnerable configuration is available online.
Organisations should patch exposed MLflow servers
MLflow users should update to version 3.15.0 or later as soon as possible. Security teams should also review their internet-facing MLflow servers and confirm that unauthenticated webhook functionality does not expose sensitive internal resources.
Administrators should inspect audit logs for suspicious webhook activity, unusual requests to internal addresses and signs of cloud metadata access. They should also review cloud credentials and secrets that may have been exposed before remediation.
Conclusion
The MLflow vulnerability CVE-2026-64849 creates a serious risk for organisations that run exposed, unpatched instances. Active exploitation makes fast patching, log review and credential checks essential, especially for MLflow environments connected to cloud services.
0 responses to “MLflow Vulnerability Actively Exploited, CISA Warns”