Within hours of the CVE-2026-64849 assignment on August 17, 2026, attackers began scanning the internet for exposed MLflow tracking servers, according to watchTowr’s LinkedIn post. The MLflow SSRF exploit lets anyone who can reach the tracking server issue arbitrary HTTP requests to internal cloud metadata services and pull out secrets. That’s the catch.
Key Takeaways
- Unauthenticated SSRF in MLflow (CVE-2026-64849) scores 9.3 on the CVSS.
- Exploit works via model‑registry webhooks that forward attacker‑controlled URLs.
- Attackers started scanning for vulnerable instances within hours of the CVE’s public release.
- Cloud metadata endpoints are the primary loot, giving away credentials and tokens.
- Patch to MLflow 3.15.0 or later, audit logs, and rotate exposed secrets immediately.
Historical Context
MLflow’s rapid adoption in data‑science teams created a large surface area before security hardened the default deployment. Early releases emphasized ease of use over access controls, which meant many teams ran tracking servers without authentication. That design choice, while convenient for experimentation, left a door open for network‑level attacks once a flaw like CVE‑2026‑64849 surfaced. The timeline from discovery to public disclosure was short, but the window for exploitation proved enough for automated scanners to strike.
Because the vulnerability lives in the webhook subsystem, any environment that relied on model‑registry notifications was instantly at risk. Teams that integrated MLflow with CI pipelines, model‑registry dashboards, or custom alerting tools suddenly found a pathway from an external request to their internal cloud metadata. The incident underscores how a single unchecked input can cascade across an entire ecosystem that treats MLflow as a trusted component.
What the MLflow SSRF Vulnerability Does
It lets a remote, unauthenticated user send a crafted request to the MLflow tracking server, which then reaches out to any URL the attacker supplies. Because the server follows redirects without proper validation, it can be tricked into contacting internal services that aren’t exposed publicly. That’s how the bug bypasses earlier mitigations.
Technical mechanics
When a model‑registry webhook fires, MLflow builds an outbound HTTP call based on the payload. The code doesn’t strip or validate the target host, so an attacker can point it at a cloud provider’s metadata endpoint—like http://169.254.169.254 on AWS or the equivalent on GCP and Azure. Once the server fetches that URL, it returns the response to the attacker, effectively leaking IAM roles, access keys, and other secrets. The flaw also mishandles redirects, so even if the initial URL points elsewhere, the server will follow the chain and still expose internal data.
The redirect logic treats every 3xx response as trustworthy, without checking whether the new destination falls inside a private address block. An attacker can chain a public URL that issues a 302 redirect to the metadata service, making the request appear legitimate to the MLflow client. Because the tracking server runs with the same network permissions as the host, it can reach the metadata endpoint directly, bypassing any perimeter firewall that only filters inbound traffic.
In practice, the exploit works in two steps. First, the attacker triggers a webhook by creating or updating a model entry. Second, the payload contains a malicious URL that the server dutifully fetches. The response travels back through the webhook channel, giving the attacker raw JSON or plain‑text data from the metadata service. No additional authentication is required once the webhook endpoint is reachable from the internet.
How Quickly Attackers Moved
watchTowr reported that they saw “bad actors indiscriminately scanning for exposed MLflow instances online” within hours of the CVE being assigned. Their global honeypot telemetry captured dozens of IPs probing for the vulnerable endpoint on August 18, 2026. One LinkedIn post from Yordan Ganchev, principal threat intelligence specialist at watchTowr, summed it up:
It allows an attacker to exploit a flaw in MLflow’s model-registry webhooks to proxy requests through the affected system and interact with internal services.
That statement isn’t hyperbole; the data shows a surge in traffic aimed at the /api/2.0/mlflow/registry/webhooks path. The scans are coming from a mix of cloud‑based bots and compromised hosts, and they’re targeting both public‑facing and internal‑only MLflow deployments.
Telemetry indicates that the scanning scripts rotate user‑agents every few seconds, trying to evade simple signature‑based blocks. Some of the probing IPs belong to well‑known cloud regions, suggesting that attackers are using inexpensive compute to flood large address spaces. The pattern mirrors classic internet‑wide sweeps: start broad, then narrow in on hosts that respond with a 200 status on the webhook endpoint.
Within a day, the volume of attempts peaked. After that, the rate steadied, indicating that automated tools had compiled a list of live targets and were now focusing on exploitation rather than discovery. The rapid shift from reconnaissance to exploitation left many operators unaware that their servers had already been queried.
Why Cloud Metadata Is a Prime Target
Cloud metadata services are designed to be reachable only from the instance itself. They hand out temporary credentials, service account tokens, and even SSH keys. When an attacker can coax a server into querying those endpoints, they essentially walk away with the keys to the kingdom. That’s why the SSRF bug is so dangerous for organizations that run MLflow on AWS, GCP, or Azure.
- Metadata endpoint exposure can reveal access keys that grant full API access.
- Service‑account tokens can be exchanged for broader cloud permissions.
- Leaked SSH keys let attackers jump straight onto the host.
- Because MLflow often runs in CI/CD pipelines, the blast radius can extend to build servers and data stores.
These credentials are not static. Many cloud providers issue short‑lived tokens that rotate automatically, but a single successful request can capture the current token and give the attacker a window of privileged access. Once inside, lateral movement becomes trivial: the attacker can enumerate other services, read storage buckets, or spin up new compute instances.
Beyond raw credentials, the metadata service also returns information about the instance profile, network configuration, and attached IAM policies. That intelligence helps threat actors craft follow‑up attacks that are tailored to the target’s exact permissions, reducing the noise of brute‑force attempts.
We’ve seen similar attacks on other AI platforms, but the combination of an open‑source tool that’s widely adopted and a lack of default authentication makes MLflow a low‑hanging fruit.
Remediation Steps for Operators
If you’re running MLflow, you’ve got to act now. The vendor released a fix in version 3.15.0, which adds strict URL validation and blocks redirects to private IP ranges. Here’s what you should do:
- Upgrade every MLflow instance to 3.15.0 or later immediately.
- Enable network‑level firewalls that block outbound traffic to known metadata IP ranges.
- Audit your webhook configurations; remove any that aren’t essential.
- Review audit logs for any outbound requests to
169.254.169.254or similar addresses. - Rotate any cloud credentials that may have been exposed, and revoke old tokens.
Don’t assume that patching alone will fix everything. The vulnerability allowed attackers to exfiltrate data before you even knew they were there, so you need to treat this as a potential breach.
Additional hardening steps are advisable. Deploy a reverse‑proxy in front of the tracking server that enforces a whitelist of outbound domains. Turn on TLS termination to guarantee that any inbound webhook payload is encrypted in transit. Finally, set up real‑time alerting for outbound HTTP calls that match the metadata IP pattern, so you can catch any lingering attempts.
Broader Implications for AI Platform Security
This incident shines a light on a systemic issue: AI tooling often ships with minimal security defaults because the focus is on rapid experimentation. That mindset doesn’t translate well to production environments where models handle sensitive data. The MLflow SSRF bug proves that a single oversight in webhook handling can open the door to cloud‑wide credential theft.
It’s ironic that a platform built to track and reproduce experiments ends up being a vector for stealing the very infrastructure that runs those experiments. Companies that embed MLflow in their pipelines need to treat it like any other critical service—apply zero‑trust networking, enforce authentication, and monitor outbound traffic.
We’ve also seen that the open‑source community can respond quickly; the patch landed within days of the CVE disclosure. But the lag between discovery and widespread adoption of the fix is where attackers profit. That gap is the real security challenge.
Future releases will likely bake stricter validation into the core library, but organizations must also adopt a culture of continuous review. Security cannot be an afterthought that only appears when a CVE makes headlines. The cost of a breach far outweighs the effort of a few extra firewall rules.
What This Means For You
If you’re a developer who’s integrated MLflow into a CI/CD workflow, you should assume that any instance that hasn’t been patched is compromised. Check your CI logs for unexpected outbound calls, and treat any leaked credentials as if they were actively being used.
Founders, you can’t afford to ignore the supply‑chain risk that open‑source AI tools introduce. Conduct a quick inventory of every MLflow deployment, enforce strict network egress policies, and make sure your security team is scanning for the CVE‑2026‑64849 fingerprint. The cost of a breach far outweighs the effort of a few extra firewall rules.
Scenario one: a data‑science team pushes a new model version, the webhook fires, and the server silently contacts the AWS metadata endpoint. Within minutes the attacker has a set of access keys that can spin up new instances, copy S3 buckets, and modify IAM policies. The team never sees the request because it happens outbound.
Scenario two: a startup runs MLflow on a managed Kubernetes cluster. The pod’s egress is unrestricted, so the SSRF payload reaches the GCP metadata server. The attacker extracts a service‑account token, then uses it to read BigQuery datasets that contain customer PII. The breach is discovered only after an unusual data‑export alert fires weeks later.
Scenario three: an enterprise CI system uses MLflow to log experiment artifacts. A compromised build agent injects a malicious webhook URL, causing the tracking server to query the Azure metadata service. The response includes a client secret that grants admin access to the entire subscription. The breach spreads across multiple workloads before the security team notices the anomalous outbound traffic.
All three examples share a common thread: an unauthenticated request that uses a trusted internal component. The mitigation path is the same—patch, lock down egress, and rotate secrets. Treat the SSRF as a breach indicator, not just a vulnerability.
Going forward, the industry will need to bake security into the core of AI tooling, not bolt it on after the fact. Will future versions of MLflow ship with mandatory authentication and hardened webhook handling, or will we keep playing catch‑up every time a new flaw surfaces?
Key Questions Remaining
- How many unpatched MLflow instances remain in the wild after the initial advisory?
- What processes will open‑source maintainers adopt to validate external URLs before they reach production?
- Can automated scanning tools be tuned
Primary sources: github.com (Vendor advisory for CVE-2026-25895).
Vulnerability facts: CVE-2026-64849
- CVSS score: 9.3 (Critical), per NIST NVD
- NVD entry published: 2026-08-17
- Actively exploited: Not currently in CISA’s Known Exploited Vulnerabilities catalog
Vulnerability facts: CVE-2026-25895
- CVSS score: 9.8 (Critical), per NIST NVD
- NVD entry published: 2026-02-09
- Actively exploited: Not currently in CISA’s Known Exploited Vulnerabilities catalog
Data: NIST National Vulnerability Database and CISA Known Exploited Vulnerabilities Catalog.
