What Happened
On August 18, 2026, multiple security researchers reported that a new unauthenticated Server‑Side Request Forgery (SSRF) vulnerability, identified as CVE‑2026‑64849, is being actively exploited against the popular open‑source AI platform MLflow. The flaw allows an attacker to force a vulnerable tracking server to make arbitrary HTTP requests to internal cloud metadata services, exfiltrating highly privileged cloud credentials and secrets. In parallel, a second critical issue (CVE‑2026‑25895) affects the FUXA SCADA/ HMI tool, but the focus of this article is the MLflow SSRF chain.
WatchTowr’s global Attacker Eye honeypot network observed exploitation attempts within hours of the CVE assignment, confirming that threat actors are already scanning for exposed MLflow instances and stealing credentials at scale.
Technical Analysis
MLflow’s tracking server, when deployed without mandatory authentication, exposes a /api/2.0/mlflow/webhooks/{id}/test endpoint. An unauthenticated POST request to this endpoint triggers the platform’s webhook delivery logic, which reflects the full upstream HTTP response back to the caller. The original MLflow code validates only the initial destination URL, but it follows HTTP redirects without re‑validating the final address. By supplying a benign URL that redirects to a cloud metadata endpoint, an attacker can retrieve temporary IAM role credentials, OAuth tokens, and other sensitive configuration data from cloud providers.
The vulnerability impacts all MLflow versions prior to 3.15.0. The flaw is amplified on cloud‑hosted deployments where the MLflow server runs with high‑privilege instance roles, giving attackers unrestricted access to the surrounding cloud environment. Exploit code published on public GitHub repositories demonstrates the attack in under 30 lines of Python, leveraging the requests library to automate mass exploitation.
Who’s Affected
Any organization that runs an internet‑facing or improperly firewalled MLflow tracking server with default authentication settings is at risk. The issue is especially dangerous for teams that embed cloud credentials (AWS access keys, Azure service principals, GCP service accounts) directly into the MLflow environment for model training pipelines. According to watchTowr, dozens of public MLflow instances were observed scanning Azure, AWS, and GCP metadata services within the first 24 hours after disclosure. Enterprises in finance, healthcare, and autonomous vehicle development that rely on large‑scale AI training are prime targets because the stolen credentials can be leveraged for lateral movement, data exfiltration, and ransomware deployment.
How to Protect Yourself
- Upgrade Immediately: Apply the official fix released in MLflow v3.15.0, which adds strict validation of both the initial URL and any subsequent redirects, and disables unauthenticated webhook testing by default.
- Enforce Authentication: Require authentication (OAuth, LDAP, or token‑based) for all MLflow API endpoints. Disable public exposure of the Tracking Server unless absolutely necessary.
- Network Segmentation: Place MLflow servers in isolated subnets and block outbound access to cloud metadata endpoints.
-
Audit Logs: Review server access logs for unexpected POST requests to
/api/2.0/mlflow/webhooks/. Look for outbound connections to internal metadata services. - Rotate Compromised Credentials: If you suspect exploitation, immediately revoke and rotate any cloud IAM roles or service‑account keys associated with the affected MLflow instances.
The Sable Angle
At Sable we specialize in securing AI and data‑science pipelines. Our team has built custom hardening modules that integrate directly into MLflow, enforcing zero‑trust policies and automated secret‑management rotation. By deploying our secure‑MLflow bundle, you can protect your model‑training workloads from SSRF attacks while maintaining full workflow flexibility.
For organizations looking to audit their AI stack, we offer a free assessment that maps cloud‑credential exposure pathways across your ML lifecycle. Contact us through the Sable research portal to learn more.
