Full research report

CISA warns of hackers exploiting critical MLflow vulnerability

Original reporting ↗
★ Threat intelligence assessment high confidence

Executive assessment

CVE-2026-64849 is a well-evidenced, actively exploited critical vulnerability in one of the most widely deployed open-source AI/ML platforms. The MLflow vendor's own security advisory includes a step-by-step public proof of concept, making the attack immediately reproducible by any threat actor without additional research; this explains the rapid exploitation onset observed within hours of CVE assignment. The primary operational risk is cloud credential theft via provider instance metadata endpoints, which can directly enable persistent cloud access, lateral movement, or resource abuse without any further exploitation. Default MLflow deployments—the overwhelming majority, given the no-authentication, SQLite-internal system default—are fully vulnerable with zero attacker prerequisites. The fix in MLflow 3.15.0 is definitive and technically sound; organisations unable to patch immediately should treat network isolation of MLflow endpoints as a mandatory compensating control, not an optional hardening step, given the confirmed active exploitation.

What happened

A critical unauthenticated server-side request forgery vulnerability (CVE-2026-64849) in MLflow's model-registry webhook delivery mechanism was publicly disclosed on 17 August 2026. Attackers began scanning for and exploiting exposed MLflow Tracking Server instances within hours of CVE assignment, as observed by watchTowr's global honeypot network. CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue on 19 August 2026 and mandated that US federal agencies patch by 2 September 2026 under Binding Operational Directive 26-04. Multiple security firms independently confirmed active exfiltration of cloud credentials from instance metadata services on affected hosts.

Affected scope

All MLflow installations prior to version 3.15.0; the vulnerability is fully exploitable against default configurations (no authentication, SQLite internal system) with no attacker prerequisites. MLflow has over 30 million monthly downloads and is widely deployed across any sector operating cloud-hosted AI and ML workloads. US federal agencies face a mandatory remediation deadline; cloud-hosted instances are at heightened risk due to proximity to cloud provider metadata endpoints.

Technical assessment

MLflow's default Tracking Server exposes model-registry webhook management endpoints without authentication. A guard function validates the initial webhook URL hostname against private IP ranges but does not pin the resolved IP address during subsequent HTTP connection. An attacker registers a webhook pointing to an attacker-controlled public endpoint that passes initial validation; that endpoint issues an HTTP redirect to a cloud metadata address. The MLflow server follows the redirect without re-validating the target, and the webhook test endpoint reflects the internal response body back to the caller—enabling unauthenticated read access to cloud provider IAM credentials. A secondary DNS rebinding path exploits a time-of-check/time-of-use gap between hostname resolution in the guard and at TCP connection time. Certain redirect methods additionally enable blind write requests to internal HTTP services, broadening potential impact beyond credential theft.

Recommended defensive actions

  1. Patch all MLflow instances to version 3.15.0 or later immediately; this is the only complete remediation.
  2. Restrict network access to all MLflow Tracking Server endpoints to trusted internal networks; block public internet exposure of the webhooks API at the network perimeter.
  3. Audit MLflow access logs for POST requests to /api/2.0/mlflow/webhooks/*/test originating from external or unexpected IP addresses, as an indicator of exploitation attempts.
  4. Rotate all cloud credentials—AWS IAM keys and roles, GCP service account tokens, Azure managed identity secrets—associated with any host that ran an unpatched MLflow instance accessible from the internet.
  5. Review cloud provider audit logs for abnormal API calls, resource enumeration, or new resource creation that may indicate post-exploitation activity following credential theft.

Uncertainties and evidence gaps

  • Attribution of exploitation to a specific threat actor or group has not been publicly established; the attacks appear opportunistic based on internet-wide scanning behaviour.
  • The full scope of organisations that experienced confirmed credential theft and any subsequent post-exploitation activity (persistence, lateral movement, cryptomining) is not publicly disclosed.
  • EPSS scores differ significantly between the source material (1.1%, 63rd percentile, as at 19 August 2026) and the GitHub advisory tracker (8.2%, 94th percentile), likely reflecting score updates in the days following KEV addition; this divergence does not affect the confirmed active exploitation status.
  • Whether attackers achieved persistent cloud access or caused material harm beyond credential exfiltration in any specific confirmed incident is not established from available public evidence.

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessUnauthenticated network access to the MLflow Tracking Server; no credentials, account, or prior access required on default-configured instances
ComponentModel-registry webhook delivery endpoint: POST /api/2.0/mlflow/webhooks/{id}/test; unauthenticated and response-reflecting in default MLflow configuration
MechanismSSRF guard validates the initial webhook URL's hostname against private IP ranges but does not pin the resolved address; HTTP redirects to internal or cloud-metadata targets are followed without re-validation and the test endpoint returns the proxied response body to the caller; a DNS rebinding variant additionally exploits the time-of-check/time-of-use gap between hostname resolution in the guard and at TCP connect time
ImpactUnauthenticated read access to cloud instance metadata including IAM credentials, internal-only administrative services, and internal host and port enumeration; certain redirect methods additionally enable blind write requests to internal HTTP services
DetectionAnomalous outbound HTTP requests from the MLflow server process to cloud metadata IP ranges (169.254.169.254 on AWS; equivalent ranges on GCP and Azure); unexpected POST requests to /api/2.0/mlflow/webhooks/*/test in server access logs from external or unknown sources; cloud audit log entries showing credential use from unfamiliar IP addresses or at anomalous times
MitigationUpgrade to MLflow 3.15.0, which introduces SSRFProtectedHTTPAdapter performing peer IP validation immediately after socket connection, covering all HTTP redirect chains and closing the DNS rebinding time-of-check/time-of-use window
Exploitation status

Active exploitation confirmed by CISA KEV addition on 19 August 2026; watchTowr's global honeypot network observed attackers targeting exposed MLflow Tracking Server instances within hours of CVE assignment on 17 August 2026, with confirmed exfiltration of cloud credentials from cloud metadata endpoints.

Research process

Investigation began with the CISA KEV addition of CVE-2026-64849 and the supplied BleepingComputer article, which named watchTowr and the MLflow vendor advisory as primary sources. The GitHub Advisory Database entry and the MLflow vendor advisory on GitHub provided definitive technical confirmation of the mechanism, affected versions, public proof of concept, and fix. NVD independently corroborated the critical CVSS score and publication date. The Hacker News and SecurityWeek provided two further independent news sources confirming exploitation timeline and watchTowr honeypot findings. Direct access to the CISA alert URL and the watchTowr social media post was blocked by the respective servers, but the exploitation status and timeline were consistently corroborated across four independent verified sources.

  1. What does the primary news source report about CVE-2026-64849, and what primary sources and claims require verification?
    Fetched BleepingComputer article on CISA's MLflow warning
    bleepingcomputer.com ↗

    Confirmed CVE-2026-64849 as a DNS-rebinding SSRF bypass in MLflow's webhook delivery, patched in 3.15.0; CISA KEV addition on 19 August 2026; watchTowr confirmed exploitation targeting cloud metadata credentials; BOD 26-04 mandate cited.

    why Established the core event and identified watchTowr, the MLflow advisory, and CISA KEV as primary sources requiring independent verification.

  2. What independent sources cover CVE-2026-64849, and are there primary advisory or database records available?
    Searched for CVE-2026-64849 across security publications and advisory databases

    Multiple independent outlets (The Hacker News, SecurityWeek) and advisory trackers (GitLab, NVD, IONIX) confirmed the vulnerability; GitHub Advisory Database and NVD identified as primary technical records for verification.

    why Established a map of verifiable independent sources before opening individual URLs, avoiding redundant fetches.

  3. What are the full technical details, affected versions, fix reference, and CVSS vector from the primary advisory database?
    Fetched GitHub Advisory Database entry for GHSA-7gwp-5pfp-969j
    github.com ↗

    CVSS 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N); affects MLflow < 3.15.0; fix in PR #24258 via SSRFProtectedHTTPAdapter; CWE-918; independently discovered by multiple researchers; published 2 August 2026, reviewed 17 August 2026.

    why Primary advisory database record independently confirms patch version, CVSS vector, and fix approach without reliance on secondary news reporting.

  4. Does the MLflow vendor's own advisory repository confirm the mechanism and contain a public proof of concept?
    Fetched MLflow vendor security advisory on GitHub
    github.com ↗

    Vendor advisory confirms three concurrent weaknesses: unauthenticated access, incomplete IP validation (no pinning), and uncontrolled redirect following; full public PoC demonstrating the attack flow is included in the advisory itself; fix commit ba94952 implements connection-time peer IP validation.

    why Vendor-published PoC establishes that the attack is fully documented and accessible to any threat actor, confirming that rapid exploitation after CVE assignment is expected and consistent with observed behaviour.

  5. What does NVD record for CVE-2026-64849 regarding score, CWE, official references, and CISA KEV status?
    Fetched NVD vulnerability detail page for CVE-2026-64849
    nvd.nist.gov ↗

    NVD confirms CVSS 9.3 critical, CWE-918, publication date 17 August 2026; references patch commit ba94952, GHSA-7gwp-5pfp-969j, and MLflow release v3.15.0; CISA KEV inclusion noted.

    why US government primary record independently corroborates scoring, patch version, and KEV inclusion without depending on secondary reporting; provides a stable authoritative citation.

  6. Does The Hacker News independently corroborate the exploitation timeline, watchTowr findings, and federal remediation deadline?
    Fetched The Hacker News article on MLflow exploitation
    thehackernews.com ↗

    Independently confirms CVE assignment date (17 August), CISA KEV date (19 August), federal agency patch deadline (2 September 2026), and watchTowr's observation of exploitation within hours of CVE assignment; also covers a concurrent FUXA vulnerability providing useful comparative context.

    why Second independent news source corroborating the full timeline and watchTowr findings without reliance on BleepingComputer; federal patch deadline date confirmed.

  7. Does SecurityWeek provide additional detail on attacker behaviour or watchTowr's methodology that corroborates or contradicts other sources?
    Fetched SecurityWeek article on MLflow exploitation
    securityweek.com ↗

    Confirms watchTowr honeypot observations of in-the-wild exploitation targeting cloud metadata services; notes attackers use internet scanning to identify exposed MLflow instances; corroborates CISA KEV addition and mandatory federal remediation without contradicting other sources.

    why Third independent verified source consistently confirming active exploitation status, providing sufficient corroboration across distinct editorial outlets to support high confidence.

Named in this story
ActorsUnknown financially motivated threat actors
TargetsOrganisations running MLflow Tracking Server in default configurationCloud-hosted AI/ML infrastructure (AWS, GCP, Azure)US Federal Civilian Executive Branch agencies (under BOD 26-04 mandate)
Related CVEs CVE-2026-64849

Research coverage

All 68 registered source leaves were evaluated for this run: 55 completed, 0 were unavailable, 6 failed and 7 were disabled. For this story, 5 registered sources supplied useful evidence (3 primary, 1 corroborating, 1 contextual and 0 PoC/exploit references). 50 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 68 sources
SourceRun resultValueWhy it was useful — or not
BleepingComputernews ok8 records Primary evidence2 matched items Published the source report used to frame and date the event. Supplied independent analysis opened and verified during focused research.
CISA KEVkev ok1673 records Primary evidence1 matched items Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue.
NVDcve ok900 records Primary evidence1 matched items Supplied a vendor or government advisory opened and verified during focused research.
CISA Alertsnews ok empty0 records Corroborating1 matched items A page from this source was opened and verified during focused research.
FIRST EPSSepss ok Context1 matched items Added exploitation-probability context; EPSS does not itself prove exploitation.
AlienVault OTXdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory stale fallback0 records Failed The current collection attempt failed; this source cannot support the report.
Cisco Talosnews ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok264 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok686 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1009 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
DNSDumpster domain IOC enrichmentresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch failed0 records Failed The current collection attempt failed; this source cannot support the report.
GitHub topic: exploitresearch failed0 records Failed The current collection attempt failed; this source cannot support the report.
GitHub topic: penetration-testingresearch failed0 records Failed The current collection attempt failed; this source cannot support the report.
GitHub topic: pocresearch failed0 records Failed The current collection attempt failed; this source cannot support the report.
GitHub topic: vulnerabilityresearch failed0 records Failed The current collection attempt failed; this source cannot support the report.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok4 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok7 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok15 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok17 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1590 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP Galaxyresearch ok3 records Checked — no match The source completed, but none of its retained records matched this story.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Rapid7news ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
The Hacker Newsnews ok16 records Checked — no match The source completed, but none of its retained records matched this story.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok3 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 6 opened outside the registered collection
References & evidence
Vulnerability & exploitation2
CVE-2026-64849 CISA KEV MLflow MLflow · added 2026-08-19 CISA catalog ↗
CVE-2026-64849 EPSS 1.1% 63th percentile exploitation probability
Technical references1
github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j ↗

Repository captured from the source article as technical context; not validated as PoC or exploit code.

PoC & exploit code2
MLflow Security Advisory GHSA-7gwp-5pfp-969j – Vendor Advisory with Public PoC github.com ↗

Vendor-published advisory contains a step-by-step public proof of concept demonstrating the three-stage unauthenticated SSRF attack via webhook redirect bypass

GitHub Advisory Database – GHSA-7gwp-5pfp-969j github.com ↗

Advisory database entry with PoC outline, fix reference (PR #24258, commit ba94952), and independently discovered researcher credits

Vendor & gov advisories3
MLflow Security Advisory GHSA-7gwp-5pfp-969j – Unauthenticated Full-Read SSRF in Webhook Delivery github.com ↗

Primary vendor advisory detailing mechanism, affected versions (< 3.15.0), and fix implementation

NVD – CVE-2026-64849 nvd.nist.gov ↗

US government primary record confirming CVSS 9.3 critical, CWE-918, publication date 17 August 2026, and CISA KEV inclusion

GitLab Advisory Tracker – CVE-2026-64849 (MLflow pypi) advisories.gitlab.com ↗

Independent advisory tracker confirming affected and patched versions; corroborates fix in 3.15.0

Analysis & research3
CISA Warns of Hackers Exploiting Critical MLflow Vulnerability – BleepingComputer bleepingcomputer.com ↗

Primary news report citing watchTowr honeypot findings, CISA BOD 26-04 mandate, and MLflow advisory quote on unauthenticated endpoint exposure

Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets – The Hacker News thehackernews.com ↗

Independent corroboration of exploitation timeline, watchTowr findings, and federal agency patch deadline of 2 September 2026

MLflow Vulnerability Exploited for Cloud Credential Theft – SecurityWeek securityweek.com ↗

Third independent source confirming active exploitation and watchTowr honeypot observations targeting cloud metadata services