CISA Warns of Hackers Exploiting Critical MLflow Vulnerability

CISA added CVE-2026-64849 to its Known Exploited Vulnerabilities (KEV) catalog on August 19, 2026, after security researchers confirmed active in-the-wild exploitation of a critical Server-Side Request Forgery (SSRF) vulnerability in MLflow — the widely used open-source machine learning lifecycle platform with over 60 million monthly downloads.

The flaw carries a CVSS score of 9.3 (Critical) and allows unauthenticated attackers to exfiltrate cloud credentials and secrets by abusing MLflow's webhook delivery mechanism.

The Vulnerability

CVE-2026-64849 is a TOCTOU (Time-of-Check to Time-of-Use) redirect bypass in MLflow's model-registry webhook handling.

Root cause: The unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() against the original registered URL. However, the webhook delivery code in mlflow/webhooks/delivery.py follows HTTP redirects and re-resolves hostnames without pinning the previously validated address.

An attacker can register a webhook pointing to an attacker-controlled server — which passes validation as a legitimate public IP. When the test endpoint fires, the attacker's server returns a 302 redirect to an internal address (such as the AWS Instance Metadata Service at 169.254.169.254). MLflow follows the redirect, fetches the internal resource, and — critically — returns the full HTTP response body back to the caller, turning a standard SSRF into a full-read SSRF with credential exfiltration capability.

MLflow had previously added destination validation in version 3.10.0, but that check only applies to the initially registered hostname — CVE-2026-64849 bypasses it entirely via the redirect chain.

Active Exploitation

Cybersecurity firm watchTowr observed automated scanners targeting cloud-hosted MLflow endpoints within hours of CVE assignment on August 17, 2026, using their global Attacker Eye honeypot network. Their principal threat intelligence specialist Yordan Ganchev stated:

"watchTowr Intel is observing in-the-wild exploitation of a critical unauthenticated Server-Side Request Forgery vulnerability in MLflow... Attackers are exploiting the vulnerability to reach cloud metadata services directly, and exfiltrating cloud credentials and secrets."

The primary attack pattern involves stealing AWS IAM credentials from the Instance Metadata Service (169.254.169.254/latest/meta-data/iam/security-credentials/), which can then be used for lateral movement within cloud environments.

CISA KEV Mandate

Under Binding Operational Directive 26-04, U.S. Federal Civilian Executive Branch (FCEB) agencies are required to patch CVE-2026-64849 within two weeks of its KEV addition. CISA's SSVC classification assessed the vulnerability as:

• Exploitation: Active
• Automatable: Yes
• Technical Impact: Total

Affected Versions and Patch

The fix pins the validated IP address at connection time, preventing the redirect-based bypass.

Attack Prerequisites

• Target MLflow instance must be network-accessible (internet-facing or reachable by attacker)
• No authentication required — the webhook test endpoint is publicly accessible by default
• Attack is fully automatable (CISA SSVC assessment)

Recommendations

1. Upgrade to MLflow 3.15.0 immediately. This is the only complete remediation.
2. Restrict public access to MLflow Tracking Servers — place behind a reverse proxy, VPN, or identity-aware gateway.
3. Rotate cloud credentials for any MLflow host that may have been exposed to the internet, particularly AWS IAM credentials accessible via IMDS.
4. Review webhook configurations for unfamiliar or attacker-controlled URLs.
5. Audit logs for requests to /api/2.0/mlflow/webhooks/*/test, redirect chains to private IP ranges (169.254.x.x, 10.x.x.x, 172.16-31.x.x, 192.168.x.x), and unusual outbound HTTP activity.
6. Inventory shadow MLflow instances — development or experimental deployments are often overlooked but equally vulnerable.

References

• BleepingComputer — CISA warns of hackers exploiting critical MLflow vulnerability
• The Hacker News — Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets
• Security Affairs — U.S. CISA adds MLflow flaw to Known Exploited Vulnerabilities catalog
• watchTowr — In-the-Wild Exploitation Observed
• CVE-2026-64849 — CISA KEV Catalog