AI and Tech Summaries - AI Weekly Malaysia

Summaries

Short AI and tech summaries with source links, signal scores, and why each update matters for builders, founders, and Malaysian tech workers.

Window

Today Yesterday This week Last week This month Last month All time

Showing 1-1 of 1 results

Date	Provider	Score	Summary
19 Aug 2026, 1:44 AM	The Hacker News	8.0	Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets A critical unauthenticated SSRF vulnerability in MLflow (CVE-2026-64849, CVSS 9.3) is being actively exploited in the wild within hours of its CVE assignment on August 17, 2026. Attackers are scanning for exposed MLflow Tracking Servers and abusing the model-registry webhooks to proxy requests to cloud metadata endpoints, exfiltrating cloud credentials and secrets. The flaw affects versions prior to 3.15.0 and bypasses earlier SSRF fixes due to how MLflow handles web redirects. Why: If you run MLflow Tracking Server exposed to the internet—especially on AWS, GCP, or Azure—patch to 3.15.0 immediately, rotate any cloud credentials that may have been exposed via metadata endpoints (169.254.169.254), and audit logs for unexpected webhook-triggered outbound requests. This is not theoretical: watchTowr honeypots caught indiscriminate scanning starting the same day the CVE was published. security mlflow ssrf cloud-credentials vulnerability

Date

Provider

Score

Summary

19 Aug 2026, 1:44 AM

The Hacker News

8.0

Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets

A critical unauthenticated SSRF vulnerability in MLflow (CVE-2026-64849, CVSS 9.3) is being actively exploited in the wild within hours of its CVE assignment on August 17, 2026. Attackers are scanning for exposed MLflow Tracking Servers and abusing the model-registry webhooks to proxy requests to cloud metadata endpoints, exfiltrating cloud credentials and secrets. The flaw affects versions prior to 3.15.0 and bypasses earlier SSRF fixes due to how MLflow handles web redirects.

Why: If you run MLflow Tracking Server exposed to the internet—especially on AWS, GCP, or Azure—patch to 3.15.0 immediately, rotate any cloud credentials that may have been exposed via metadata endpoints (169.254.169.254), and audit logs for unexpected webhook-triggered outbound requests. This is not theoretical: watchTowr honeypots caught indiscriminate scanning starting the same day the CVE was published.