MLflow SSRF flaw steals cloud credentials

Attackers are exploiting an unauthenticated server-side request forgery (SSRF) flaw in MLflow, tracked as CVE-2026-64849, to reach cloud metadata services and steal cloud credentials and secrets. The default MLflow Tracking Server and all versions before 3.15.0 are affected. The issue carries a CVSS score of 9.3.

The vulnerability exists because the model-registry webhooks API in the default tracking server is exposed without authentication. One exposed endpoint returns the upstream response status and body to the caller. An SSRF protection added in MLflow 3.10.0 can be bypassed, which allows the server to make HTTP requests to internal network addresses.

Security firm WatchTowr reported that exploitation began within hours of the CVE being assigned. According to the firm, attackers have targeted cloud-hosted MLflow instances to reach cloud provider metadata endpoints and exfiltrate credentials and secrets.

MLflow is an open-source platform used to track experiments, package code and manage model registries. The project has more than 27,000 stars on GitHub and sees over 60 million downloads per month. Many deployments run in cloud environments, where metadata endpoints often provide temporary credentials to instances and workloads.

U.S. cyber authorities added CVE-2026-64849 to the Known Exploited Vulnerabilities catalog and instructed federal agencies to patch affected systems within two weeks under Binding Operational Directive 26-04. The MLflow advisory and subsequent notices identify version 3.15.0 as the patched release; all versions before 3.15.0 are affected.

Organizations running MLflow are advised to upgrade exposed systems to 3.15.0, review audit logs for indicators of compromise and rotate any credentials that may have been exposed. WatchTowr urged organizations to prioritize patching and to check whether sensitive credentials were exfiltrated.