What CISA Flagged
CISA says attackers are exploiting CVE-2026-64849 in MLflow, an open-source AI engineering platform backed by the Linux Foundation and used broadly for evaluating and monitoring LLM and agent workloads.
The flaw is a critical DNS-rebinding SSRF bypass in MLflow's outbound webhook delivery. It was patched in version 3.15.0, but unpatched instances can let attackers reach internal services or cloud metadata endpoints without privileges under the default tracking-server model described in the advisory.
Why MLflow Exposure Gets Expensive
This is not just another SSRF headline. The source reporting says the vulnerable POST /api/2.0/mlflow/webhooks/{id}/test path can return upstream response status and body to the caller, which means an exposed MLflow instance can become a relay into internal services and metadata-backed credential stores.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
Free. Weekday mornings. Unsubscribe anytime.
Built from 100+ trusted cybersecurity sources.
watchTowr says attackers began scanning for MLflow systems within hours of the CVE assignment and are already exploiting the issue to reach cloud metadata services and exfiltrate cloud credentials and secrets. That changes the response from patching alone to patching plus credential-exposure review.
Why This Matters Beyond AI Teams
MLflow reportedly sees more than 30 million monthly downloads and is often deployed by engineering or data teams rather than by traditional infrastructure owners. That creates the exact sort of ownership gap that slows response when a new exposure lands.
The risky assumption is that an internal AI platform stays inside a safe boundary by default. Once webhook testing can be abused to reach metadata and internal-only services, the issue belongs in the cloud and identity conversation too.
What Teams Should Do Next
Treat this as a credentials-and-internal-reachability problem, not only an application update.
- Upgrade MLflow to 3.15.0 or later everywhere it exists, including lab or developer-run instances.
- Identify any MLflow deployment that is internet reachable or weakly authenticated and move it ahead of normal patch backlog work.
- Review audit logs and webhook activity for signs that metadata endpoints, internal hosts, or internal admin services were queried through the vulnerable flow.
- Assume exposed cloud IAM credentials or secrets may need rotation if there is any uncertainty about prior abuse.
- Bring data, engineering, cloud, and security owners into the same thread early because MLflow often lives between their boundaries.
Source Context
CyberExperts used BleepingComputer's reporting as the primary source for this article and preserved the details that make the story operationally useful: CVE-2026-64849, the DNS-rebinding SSRF bypass, the default webhook test path, the fixed MLflow version, and the active-credential-theft angle described by watchTowr.
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
