Ethical Hacking News
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical SSLR (Server-Side Request Forgery) vulnerability in MLflow, a popular platform for managing machine learning workflows, to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability, tracked as CVE-2026-64849, has a CVSS score of 9.3, making it a high-priority threat for organizations that rely on MLflow for their machine learning operations. This article provides an in-depth look at the vulnerability, its impact, and the steps organizations can take to address it and prevent exploitation.
MLflow has a critical Server-Side Request Forgery (SSRF) vulnerability, CVE-2026-64849, with a CVSS score of 9.3. The vulnerability allows remote attackers to access cloud metadata services and steal credentials and secrets. Organizations that rely on cloud-based services are at risk of having sensitive data exposed. Immediate action is needed to address the vulnerability and ensure MLflow instances are properly secured. Steps to address the vulnerability include updating to the latest MLflow version, enabling authentication, rate limiting, and implementing additional security measures.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently added a critical Server-Side Request Forgery (SSRF) vulnerability in MLflow, a popular platform for managing machine learning workflows, to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability, tracked as CVE-2026-64849, has a CVSS score of 9.3, making it a high-priority threat for organizations that rely on MLflow for their machine learning operations.
The MLflow vulnerability allows remote attackers to make requests from an exposed MLflow server to internal services, including cloud metadata endpoints, potentially exposing temporary cloud credentials. This vulnerability is particularly concerning because it can be exploited without authentication, making it easily accessible to attackers. According to watchTowr, a cybersecurity firm, the vulnerability has already been actively exploited by attackers, who are using it to access cloud metadata services and steal credentials and secrets.
The impact of this vulnerability extends beyond just MLflow, as it can be exploited to access cloud metadata services, which are often used to store and manage sensitive data. This means that organizations that rely on cloud-based services may be at risk of having their sensitive data exposed. The vulnerability is also significant because it highlights the importance of ensuring that machine learning platforms are properly secured and monitored.
The CVE-2026-64849 vulnerability was assigned on August 17, 2026, and it is already being actively exploited by attackers. WatchTowr has observed widespread scanning for exposed MLflow instances, and Attacker Eye, a global honeypot network, has detected attempts against cloud-hosted instances. This highlights the need for organizations to take immediate action to address this vulnerability and ensure that their MLflow instances are properly secured.
To address this vulnerability, organizations should take the following steps:
1. Update to the latest version of MLflow, which is currently 3.15.0.
2. Ensure that all MLflow instances are properly configured and secured, including enabling authentication and setting up rate limiting.
3. Monitor for exposed MLflow instances and take action to secure them immediately.
4. Implement additional security measures, such as using a web application firewall (WAF) or a security information and event management (SIEM) system.
By taking these steps, organizations can help prevent the exploitation of the CVE-2026-64849 vulnerability and ensure the security of their MLflow instances.
Related Information:
https://www.ethicalhackingnews.com/articles/US-CISA-Adds-MLflow-Flaw-to-Known-Exploited-Vulnerabilities-Catalog-A-Critical-SSRF-Vulnerability-Affects-Thousands-of-Machine-Learning-Platforms-ehn.shtml
https://securityaffairs.com/197558/hacking/u-s-cisa-adds-a-mlflow-flaw-to-its-known-exploited-vulnerabilities-catalog.html
https://nvd.nist.gov/vuln/detail/CVE-2026-64849
https://www.cvedetails.com/cve/CVE-2026-64849/
Published: Thu Aug 20 04:57:53 2026 by llama3.2 3B Q4_K_M
