Security Alert: MLflow Critical SSRF Vulnerability (CVE-2026-64849)

As organizations rush to integrate artificial intelligence into their production workflows, the infrastructure supporting these models has become a prime target for sophisticated threat actors. This week, the Cybersecurity and Infrastructure Security Agency (CISA) added a critical vulnerability in the MLflow platform—CVE-2026-64849—to its Known Exploited Vulnerabilities (KEV) catalog. This Server-Side Request Forgery (SSRF) flaw is currently being exploited in the wild, posing a significant risk to data science teams and cloud environments globally.

What is CVE-2026-64849?

CVE-2026-64849 is a critical vulnerability affecting MLflow, one of the world’s most popular open-source platforms for managing the machine learning lifecycle. The flaw allows an unauthenticated attacker to bypass security validations and force the MLflow server to make requests to internal network resources or cloud metadata services.

With a CVSS v3.1 score of 9.3 (Critical), the vulnerability represents a high-impact threat because it enables attackers to bridge the gap between an internet-exposed application and sensitive internal data.

The Technical Breakdown: Bypassing Webhook Validation

The vulnerability exists within the MLflow webhook testing endpoint (POST /api/2.0/mlflow/webhooks/{id}/test). While MLflow implemented validation logic to prevent users from targeting internal IP addresses or reserved CIDR ranges (like 169.254.169.254), researchers discovered a critical flaw in the implementation.

The validation process only checks the initial URL provided in the request. However, the delivery mechanism responsible for sending the “test” webhook follows HTTP redirects. An attacker can host a malicious server that initially provides a “safe” URL for validation but then redirects the MLflow server to a sensitive internal address. Because the delivery logic fails to re-validate or “pin” the IP address after a redirect, the request succeeds against the restricted target.

Severe Impact: Cloud Credential Theft

The primary goal of attackers exploiting CVE-2026-64849 is the exfiltration of sensitive credentials from cloud metadata services. In modern cloud environments (AWS, Azure, and Google Cloud), instances can access temporary credentials and configuration data through a specific metadata IP (169.254.169.254). By exploiting this SSRF, an attacker can:

• Exfiltrate Cloud Credentials: Steal IAM role tokens or service account keys, granting them access to the wider cloud environment.
• Internal Reconnaissance: Map out internal subnets and services that are not exposed to the public internet.
• Data Exfiltration: Access internal databases or file shares used to store training datasets and proprietary models.

This vulnerability turns a single exposed MLflow instance into a gateway for a full cloud account takeover.

Active Exploitation and CISA KEV

On August 19, 2026, CISA officially added CVE-2026-64849 to its KEV catalog following reports of active exploitation. Security researchers have observed large-scale automated scanning for the vulnerable /api/2.0/mlflow/webhooks/ path across the internet. Threat actors are moving quickly to capitalize on the lag time between patch availability and enterprise deployment.

For organizations following CISA’s Binding Operational Directive 26-04, remediation is mandatory and must be prioritized to prevent unauthorized access to federal AI projects and data.

Mitigation and Immediate Actions

The vulnerability affects all versions of MLflow prior to 3.15.0. To secure your environment, follow these steps immediately:

1. Update MLflow: Upgrade your MLflow installation to version 3.15.0 or later. The fix introduces stricter URL validation and prevents the redirection bypass in the webhook delivery service.
2. Restrict Network Access: If you cannot patch immediately, implement strict egress filtering on your MLflow servers. Block all traffic to the cloud metadata IP (169.254.169.254) and other internal address spaces at the firewall or VPC level.
3. Audit Access Logs: Review your MLflow and cloud provider logs for unusual requests directed at 169.254.169.254 or internal IP ranges originating from the MLflow host.
4. Credential Rotation: If you suspect an instance was compromised, rotate any cloud credentials that were accessible to the MLflow service.

Conclusion

The discovery and active exploitation of CVE-2026-64849 highlight a growing trend: the weaponization of the AI and ML development stack. As these tools move from sandboxed research environments into critical production roles, they must be hardened against traditional web vulnerabilities like SSRF. Don’t let your AI innovation become a security liability—patch your MLflow instances today.