Threat actors are currently targeting a severe server-side request forgery (SSRF) vulnerability in the popular open-source platform, MLflow. Widely used for tracking experiments and deploying models by data engineering and machine learning teams, this vulnerability poses a significant risk. Identified as CVE-2026-64849, it has received a critical CVSS score of 9.3, affecting all versions of MLflow prior to 3.15.0.
Immediate Exploitation Post-Disclosure
According to watchTowr Intel, adversaries began exploiting internet-exposed MLflow instances within hours of the flaw’s public disclosure. Utilizing their global Attacker Eye honeypot network, watchTowr detected attempts to harvest cloud credentials and sensitive tokens from these systems. The flaw stems from a default MLflow Tracking Server setup that lacks mandatory authentication, relying on a local SQLite backend and exposing critical webhooks APIs to untrusted network traffic.
Technical Details of the Vulnerability
The vulnerability lies in an unauthenticated POST request to the endpoint /api/2.0/mlflow/webhooks/{id}/test, which reflects the full upstream HTTP status code and response body. This reflection turns a standard request-forgery into a high-impact exploit, allowing attackers to access sensitive information. Although MLflow version 3.10.0 introduced a validation function to block private and cloud metadata addresses, it only evaluates the initial destination. The delivery handler in mlflow/webhooks/delivery.py, however, follows HTTP redirects without re-validating the new address.
Exploitation Across Cloud Providers
On major cloud platforms such as AWS, Azure, and Google Cloud, the reflected responses allow attackers to extract temporary IAM credentials, OAuth tokens, and environment configurations. The vulnerability also enables querying of internal microservices and loopback consoles. The rapid exploitation of this flaw reflects a trend where automated scanners quickly weaponize such vulnerabilities against exposed infrastructure.
Mitigation Measures and Future Outlook
MLflow maintainers have fixed these vulnerabilities in version 3.15.0. Organizations using internet-facing or shared Tracking Servers are advised to upgrade immediately. Since applying patches does not revoke already-exfiltrated credentials, security teams must audit access logs, rotate all cloud IAM keys, and enforce network egress filtering. Implementing identity-aware proxies can further isolate internal tracking portals from public networks, enhancing security against future threats.
