A critical vulnerability in MLflow, a widely used open-source platform for managing machine learning models and workflows, is already being exploited in the wild, and attackers are going straight after cloud credentials and secrets.
Tracked as CVE-2026-64849, this critical flaw has a CVSS score of 9.3 and affects MLflow versions older than 3.15.0. What makes it more concerning is how quickly attackers moved, within hours of the vulnerability being disclosed on August 17, watchTowr researchers began seeing scans targeting publicly exposed MLflow servers.
The vulnerability is an unauthenticated Server-Side Request Forgery (SSRF) issue. In simple terms, it can trick an MLflow server into making requests to places an attacker normally could not reach, including internal services and cloud metadata endpoints.
The problem sits in MLflow’s model-registry webhook functionality. Attackers can abuse the webhook testing endpoint to make requests through a vulnerable MLflow server. While MLflow had already introduced protections against requests to private and reserved IP addresses, researchers found a way around those controls by exploiting how the server handles HTTP redirects.
That detail makes the vulnerability particularly serious for cloud-hosted environments. An attacker can potentially use the vulnerable server to reach cloud metadata services and retrieve sensitive information such as temporary cloud credentials, access tokens, and other secrets. In the wrong environment, those credentials could provide access to additional cloud resources and services.
And this isn’t just a theoretical risk. watchTowr’s global honeypot telemetry showed indiscriminate scanning against exposed MLflow instances shortly after the flaw became public. Researchers say attackers are actively attempting to extract credentials and secrets from internal services.
For organizations using MLflow, the priority is clear: upgrade to MLflow 3.15.0 or later, particularly if the Tracking Server is accessible from the internet. Security teams should also review logs for suspicious webhook activity and determine whether cloud credentials or other secrets may have been exposed.
Let’s refine your stalking skills; go through our Instagram and LinkedIn.
