Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets
- ID
- 15338
- Status
- summarized
- Published
- 19 Aug 2026, 1:44 AM
- Fetched
- 19 Aug 2026, 4:05 AM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/attackers-exploit-mlflow-ssrf-flaw-to.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 8.0
- Created
- 19 Aug 2026, 4:05 AM
- Tags
- Audience
- developersai_ml_learnersai_agent_users
What happened
A critical unauthenticated SSRF vulnerability in MLflow (CVE-2026-64849, CVSS 9.3) is being actively exploited in the wild within hours of its CVE assignment on August 17, 2026. Attackers are scanning for exposed MLflow Tracking Servers and abusing the model-registry webhooks to proxy requests to cloud metadata endpoints, exfiltrating cloud credentials and secrets. The flaw affects versions prior to 3.15.0 and bypasses earlier SSRF fixes due to how MLflow handles web redirects.
Why it matters
If you run MLflow Tracking Server exposed to the internet—especially on AWS, GCP, or Azure—patch to 3.15.0 immediately, rotate any cloud credentials that may have been exposed via metadata endpoints (169.254.169.254), and audit logs for unexpected webhook-triggered outbound requests. This is not theoretical: watchTowr honeypots caught indiscriminate scanning starting the same day the CVE was published.
Discussion angle
How many teams in this community expose MLflow servers publicly for experiment tracking, and what's the practical patch-and-rotate playbook when a 9.3 CVSS SSRF drops and scanning starts within hours?