Executive Summary
A critical vulnerability has been identified and is being actively exploited in MLflow, a widely used open-source platform for managing the machine learning lifecycle. The flaw, tracked as CVE-2026-64849, is a Server-Side Request Forgery (SSRF) vulnerability that enables remote, unauthenticated attackers to issue arbitrary HTTP requests from the MLflow Tracking Server to internal network resources, including cloud provider metadata endpoints. This exploitation vector allows adversaries to steal sensitive cloud credentials and secrets, potentially leading to full cloud account compromise. The vulnerability affects all MLflow versions prior to 3.15.0. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this CVE to its Known Exploited Vulnerabilities catalog, mandating urgent remediation. This advisory provides a comprehensive technical analysis, threat actor insights, exploitation evidence, and actionable mitigation guidance for organizations leveraging MLflow in cloud or hybrid environments.
Threat Actor Profile
The exploitation of MLflow SSRF is currently opportunistic and widespread, with no single advanced persistent threat (APT) group attributed as of this report. Multiple financially motivated cybercriminals and initial access brokers are leveraging automated scanning tools to identify and compromise exposed MLflow Tracking Servers. These actors are primarily focused on cloud environments, seeking to harvest cloud provider credentials (such as AWS IAM tokens, Google Cloud service account keys, and Azure Managed Identity tokens) for subsequent monetization, lateral movement, or resale on underground forums. The rapid weaponization of public proof-of-concept exploits and the inclusion of this vulnerability in automated attack frameworks underscore the high risk to organizations with internet-exposed or insufficiently segmented MLflow deployments.
Technical Analysis of Malware/TTPs
The core of CVE-2026-64849 lies in the improper validation of user-supplied URLs within the MLflow model registry webhook functionality. Attackers can craft malicious webhook payloads that instruct the MLflow server to initiate HTTP requests to arbitrary destinations, including internal-only endpoints. Critically, the vulnerability bypasses previous SSRF mitigations due to inadequate handling of HTTP redirects and insufficient filtering of internal IP address ranges.
Upon successful exploitation, the attacker leverages the SSRF primitive to access cloud provider metadata services, such as the AWS Instance Metadata Service at http://169.254.169.254, Google Cloud’s metadata server at http://metadata.google.internal, or Azure’s at http://169.254.169.254/metadata/identity/oauth2/token. These endpoints, when queried from within the cloud environment, return sensitive credentials and tokens that can be used to assume roles, escalate privileges, or access cloud APIs.
Attackers have been observed using automated scripts to enumerate and exploit vulnerable MLflow endpoints. The typical attack sequence involves identifying an exposed MLflow Tracking Server, sending a crafted POST request to the /api/2.0/mlflow/registered-models/create endpoint with a malicious webhook URL, and extracting the returned credentials from the server’s response or logs. In some cases, attackers chain this SSRF with additional vulnerabilities or misconfigurations to achieve persistent access or further lateral movement within the victim’s cloud infrastructure.
Network telemetry and honeypot data indicate that attackers are using a variety of user agents and payload obfuscation techniques to evade detection. Some campaigns have incorporated the use of Tor exit nodes and cloud-based proxies to mask the origin of the attack traffic. The exploitation is highly automated, with scanning and exploitation occurring within hours of public disclosure and proof-of-concept release.
Exploitation in the Wild
Active exploitation of MLflow SSRF began almost immediately after the vulnerability was publicly disclosed and assigned a CVE. Security researchers from watchTowr and VulnCheck reported widespread scanning for MLflow Tracking Servers, with attackers leveraging both Shodan and Censys to identify internet-exposed instances. Multiple organizations have reported unauthorized access to their cloud environments traced back to compromised MLflow servers.
Honeypot deployments have captured real-world exploitation attempts, with attackers issuing SSRF payloads targeting the AWS, GCP, and Azure metadata endpoints. In several confirmed incidents, attackers successfully exfiltrated cloud credentials and used them to enumerate cloud resources, deploy cryptominers, or establish persistence via new IAM users or roles. The exploitation is not limited to a specific geography or sector; both public and private sector organizations with vulnerable MLflow deployments have been targeted.
The inclusion of CVE-2026-64849 in the CISA KEV catalog has further accelerated exploitation, as threat actors prioritize vulnerabilities with high impact and public attention. Security advisories and social media posts from watchTowr, The Hacker News, and the Reddit r/SecOpsDaily community have documented the rapid proliferation of exploit attempts and the tangible risk to unpatched environments.
Victimology and Targeting
Victims of the MLflow SSRF vulnerability span a diverse range of industries, including technology, finance, healthcare, research, and government. The common denominator among victims is the presence of internet-exposed or poorly segmented MLflow Tracking Servers, often deployed in cloud environments without adequate network controls. Organizations leveraging MLflow for machine learning model management, experiment tracking, or automated ML pipelines are at heightened risk, particularly if their deployments have access to sensitive cloud resources or secrets.
Attackers are not discriminating by organization size or sector; rather, they are leveraging automated tools to scan the entire IPv4 address space for vulnerable MLflow instances. Once a target is identified, exploitation and credential exfiltration occur rapidly, often within minutes. In several documented cases, attackers have pivoted from compromised MLflow servers to other cloud resources, highlighting the risk of lateral movement and broader cloud compromise.
Mitigation and Countermeasures
Immediate mitigation requires upgrading MLflow to version 3.15.0 or later, which includes comprehensive SSRF protections and improved input validation. Organizations should ensure that all MLflow Tracking Servers are not exposed to the public internet and are accessible only from trusted, segmented networks. Implementing strict firewall rules, network segmentation, and access controls is essential to prevent unauthorized access.
Security teams should review MLflow server logs for evidence of suspicious requests, particularly those targeting internal IP ranges or cloud metadata endpoints. Any cloud credentials potentially exposed via SSRF exploitation must be rotated immediately, and access logs for cloud provider accounts should be scrutinized for signs of unauthorized activity.
Long-term, organizations should adopt a defense-in-depth approach for all machine learning infrastructure. This includes regular vulnerability scanning, automated patch management, and the use of cloud provider controls such as instance metadata service v2 (IMDSv2) on AWS, which mitigates some SSRF risks. Monitoring for abnormal outbound traffic from MLflow servers and integrating detection rules for SSRF patterns into SIEM platforms will further reduce risk.
References
The following open-source intelligence and technical resources provide additional context and guidance:
The Hacker News: Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets (https://thehackernews.com/2026/08/attackers-exploit-mlflow-ssrf-flaw-to.html?m=1), CISA Known Exploited Vulnerabilities Catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog), watchTowr LinkedIn Post (https://www.linkedin.com/company/watchtowr/), Reddit: r/SecOpsDaily - Attackers Exploit MLflow SSRF Flaw (https://www.reddit.com/r/SecOpsDaily/comments/1vryoiv/attackers_exploit_mlflow_ssrf_flaw_to_steal_cloud/), OpenCVE MLflow (https://app.opencve.io/cve/?product=mlflow&vendor=lfprojects), MITRE ATT&CK Techniques (https://attack.mitre.org/).
About Rescana
Rescana is a leader in third-party risk management (TPRM), providing organizations with a comprehensive platform to continuously monitor, assess, and mitigate cyber risks across their digital supply chain. Our advanced analytics and threat intelligence capabilities empower security teams to proactively identify vulnerabilities, prioritize remediation, and ensure compliance with evolving regulatory requirements. For more information about how Rescana can help secure your organization’s ecosystem, or for any questions regarding this advisory, please contact us at info@rescana.com.
