Exploited MLflow SSRF flaw lets attackers steal cloud credentials from ML servers

Attackers began exploiting a critical unauthenticated flaw in MLflow, the popular open-source machine-learning platform, within hours of its disclosure. Tracked as CVE-2026-64849 and scored 9.3, the server-side request forgery bug lives in the model-registry webhook testing feature: an attacker hosts an endpoint that passes validation, then redirects MLflow to internal targets such as the cloud metadata service or loopback addresses, and MLflow returns their responses. That exposes cloud credentials, API tokens, and secrets. Because MLflow sits close to training data, artifacts, object storage, CI/CD, and inference pipelines, a compromise offers both credentials and a foothold for lateral movement. watchTowr's honeypots saw exploitation attempts almost immediately.

Check

Upgrade MLflow to version 3.15.0 or later immediately, and treat any internet-exposed instance on an earlier version as potentially probed, checking for signs of metadata access.

Affected

Organizations running MLflow before 3.15.0, especially cloud-hosted and internet-exposed (CVE-2026-64849); an unauthenticated attacker can coerce it into fetching internal targets and leak cloud credentials, tokens, and secrets.

Fix

Patch to 3.15.0, review webhook configurations for attacker URLs, inspect logs for webhook-test requests and metadata or loopback addresses, rotate credentials the server could reach, and restrict its network exposure.