MLflow SSRF Flaw Exploited in the Wild

Executive Summary

A critical Server-Side Request Forgery (SSRF) vulnerability, CVE-2026-64849, in the popular open-source MLOps platform MLflow is being actively and indiscriminately exploited in the wild. The flaw, which carries a CVSS score of 9.3, allows an unauthenticated attacker to bypass existing security controls and force the MLflow server to make requests to arbitrary internal network locations. Attackers are leveraging this to query cloud provider metadata services (e.g., 169.254.169.254) to exfiltrate access keys, tokens, and other sensitive credentials from the underlying cloud infrastructure. The vulnerability affects all MLflow versions prior to 3.15.0, and organizations are urged to upgrade immediately and ensure their instances are not exposed to untrusted networks.

Vulnerability Details

The vulnerability exists within MLflow's model-registry webhook feature. This feature is designed to notify external systems about events in the model lifecycle. While MLflow includes a validation check to prevent webhooks from being configured to point directly to private or internal IP addresses, security firm watchTowr discovered that this validation can be bypassed using an HTTP redirect.

The attack proceeds as follows:

1. The attacker configures an MLflow webhook to point to a public URL they control.
2. This URL is a legitimate public endpoint, so it passes MLflow's validation check.
3. The attacker then configures their public endpoint to respond with an HTTP 3xx redirect, pointing to a sensitive internal URL, such as http://169.254.169.254/latest/meta-data/iam/security-credentials/.
4. When MLflow attempts to send the webhook, it follows the redirect and makes a request to the internal metadata service.
5. The response from the metadata service, containing cloud credentials, is then included in the body of the webhook data sent back to the attacker's listening server.

This classic SSRF-via-redirect technique allows an unauthenticated attacker to completely compromise the security of the cloud environment hosting the MLflow instance.

Affected Systems

• MLflow versions prior to 3.15.0.

Any organization using a vulnerable version of MLflow, particularly if the MLflow Tracking Server is exposed to the internet or an untrusted network, is at high risk.

Exploitation Status

According to watchTowr, active and indiscriminate scanning for vulnerable MLflow instances began within hours of the CVE's public assignment on August 17, 2026. This indicates that multiple threat actors are now aware of the vulnerability and are actively attempting to exploit it at scale. Any exposed, unpatched MLflow server should be considered a likely target.

Impact Assessment

The impact of exploiting CVE-2026-64849 is critical. By stealing cloud credentials from the metadata service, an attacker can gain the same level of access as the role assigned to the MLflow server. In a worst-case scenario, this could be an administrative role, giving the attacker full control over the victim's cloud account. With this access, an attacker could exfiltrate or destroy data, deploy cryptocurrency miners, or pivot to other systems within the cloud environment. Given that MLflow is used to manage sensitive machine learning models and data, the compromise could also lead to intellectual property theft or model poisoning attacks.

Cyber Observables — Hunting Hints

Security teams can hunt for exploitation of this vulnerability with the following observables:

Detection Methods

• Log Analysis: Analyze MLflow application logs for the creation of webhooks. Scrutinize the target URLs for any suspicious domains. Correlate this with network logs to see if the MLflow server is making requests to the metadata service IP.
• Network Monitoring: The most reliable detection method is to monitor network traffic from the MLflow server. Any request from the server to 169.254.169.254 is highly anomalous and a strong indicator of an SSRF attack. This can be detected using VPC Flow Logs, host-based firewalls, or EDR network monitoring.
• Cloud Threat Detection: Services like AWS GuardDuty or Azure Defender for Cloud have specific detectors for SSRF attacks and access to metadata services from compromised instances. Ensure these services are enabled and alerts are monitored.

Remediation Steps

1. Upgrade MLflow: The primary remediation is to upgrade to MLflow version 3.15.0 or later, which contains a patch for this vulnerability. This is a direct application of D3FEND's Software Update.
2. Restrict Network Access: Do not expose MLflow Tracking Servers to the public internet. Access should be restricted to trusted internal networks or controlled via a VPN with strong authentication. This aligns with D3FEND's Network Isolation.
3. Harden Cloud Instance Metadata: On cloud platforms like AWS, you can mitigate the impact of SSRF by enforcing the use of Instance Metadata Service Version 2 (IMDSv2). IMDSv2 requires a session token for requests, which prevents basic SSRF exploits like this one from succeeding.
4. Rotate Credentials: If you were running a vulnerable, exposed version of MLflow, you must assume your cloud credentials have been compromised. Immediately rotate all access keys, tokens, and other secrets associated with the IAM role of the MLflow server.