Ethical Hacking News
Malicious actors have exploited two critical vulnerabilities in MLflow and FUXA to steal cloud credentials and secrets, highlighting the need for organizations to prioritize security measures to protect cloud-based systems.
Two critical vulnerabilities have been discovered in popular AI platforms: CVE-2026-64849 in MLflow and CVE-2026-25895 in FUXA. CVE-2026-64849 is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in MLflow, allowing attackers to extract sensitive data. CVE-2026-25895 is a missing authentication for a critical function and path traversal vulnerability in FUXA, enabling remote code execution. Over 60 FUXA installations are exposed to the public internet, posing a significant risk to their security. Organizations must prioritize patching, auditing, and monitoring to protect themselves against these threats.
The cybersecurity landscape has recently witnessed the emergence of two critical vulnerabilities in popular artificial intelligence (AI) platforms and software, which have been exploited by malicious actors to steal cloud credentials and secrets. The vulnerabilities in question are CVE-2026-64849 in MLflow and CVE-2026-25895 in FUXA, two open-source platforms that cater to the needs of operational technology (OT) and industrial automation.
CVE-2026-64849, which carries a CVSS score of 9.3, is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in MLflow. This flaw allows an attacker who can reach the Tracking Server (mlflow server) to issue HTTP requests to arbitrary internal cloud metadata endpoints and extract sensitive data. As noted by watchTowr, an independent security firm, attackers have been exploiting this vulnerability to reach cloud metadata services directly and exfiltrate cloud credentials and secrets. The severity of this vulnerability is underscored by the fact that it allows an attacker to exploit a flaw in MLflow's model-registry webhooks to proxy requests through the affected system and interact with internal services.
In contrast, CVE-2026-25895, which carries a CVSS score of 9.5, is a missing authentication for a critical function and path traversal vulnerability in FUXA. This flaw enables an unauthenticated, remote attacker to write arbitrary files to the server file system and achieve remote code execution. According to VulnCheck, a security firm that detected malicious scanning aimed at this vulnerability, a single IP address has been observed broadly scanning the internet for vulnerable FUXA instances. There are approximately 60 FUXA installations exposed to the public internet, which poses a significant risk to the security of these systems.
The recent exploitation of these vulnerabilities highlights the importance of prioritizing patching affected, exposed systems, reviewing audit logs for signs of compromise, and checking whether sensitive credentials have been exposed. Organizations that fail to take these measures may face significant security risks, including the theft of cloud credentials and secrets. The fact that attackers are abusing these vulnerabilities to target cloud-hosted MLflow systems in an attempt to extract credentials and secrets underscores the need for robust security measures to protect cloud-based systems.
In addition to these vulnerabilities, FUXA has experienced two other vulnerabilities, CVE-2026-25939 and CVE-2023-33831, which have witnessed active exploitation efforts over the past year. The latter vulnerability, which was first discovered in November 2025, has seen activity as recent as the day before the CVE-2026-25895 vulnerability was publicly disclosed. This highlights the ongoing threat posed by these vulnerabilities and the need for organizations to remain vigilant in their security posture.
The recent emergence of these vulnerabilities serves as a reminder of the ongoing cat-and-mouse game between security professionals and malicious actors. As attackers continue to exploit vulnerabilities in AI platforms and software, it is essential for organizations to prioritize security measures, including patching, auditing, and monitoring, to protect themselves against these threats.
In conclusion, the recent exploitation of CVE-2026-64849 and CVE-2026-25895 highlights the importance of prioritizing security measures to protect cloud-based systems. The fact that attackers are abusing these vulnerabilities to steal cloud credentials and secrets underscores the need for robust security measures to protect cloud-based systems.
Related Information:
https://www.ethicalhackingnews.com/articles/Malicious-Actors-Exploit-MLflow-and-FUXA-Vulnerabilities-to-Steal-Cloud-Credentials-and-Secrets-ehn.shtml
https://thehackernews.com/2026/08/attackers-exploit-mlflow-ssrf-flaw-to.html
https://nvd.nist.gov/vuln/detail/CVE-2026-64849
https://www.cvedetails.com/cve/CVE-2026-64849/
https://nvd.nist.gov/vuln/detail/CVE-2026-25895
https://www.cvedetails.com/cve/CVE-2026-25895/
https://nvd.nist.gov/vuln/detail/CVE-2026-25939
https://www.cvedetails.com/cve/CVE-2026-25939/
https://nvd.nist.gov/vuln/detail/CVE-2023-33831
https://www.cvedetails.com/cve/CVE-2023-33831/
Published: Tue Aug 18 14:47:10 2026 by llama3.2 3B Q4_K_M
