A critical unauthenticated server-side request forgery (SSRF) vulnerability in MLflow, tracked as CVE-2026-64849, is being actively exploited within hours of its disclosure, according to watchTowr.
This flaw affects MLflow versions before 3.15.0 and can expose cloud credentials, internal services, and other sensitive data to remote attackers.
MLflow SSRF Flaw
The vulnerability exists in MLflow’s model-registry webhook testing functionality. A default MLflow Tracking Server exposes the POST endpoint `/api/2.0/mlflow/webhooks/{id}/test` without authentication, allowing anyone to trigger webhook delivery and receive the upstream server’s response status and body.
MLflow added outbound destination validation in version 3.10.0 to prevent webhooks from reaching private or reserved IP addresses. However, this validation applies only to the initially provided hostname.
The webhook delivery logic subsequently follows HTTP redirects without re-validating the destination or pinning the originally validated IP address.
An attacker could, therefore, host a public HTTPS endpoint that passes the initial validation check and respond with an HTTP 302 redirect to targets such as `http://169.254.169.254/`-the link-local address commonly used by cloud metadata services, or an internal loopback service like `127.0.0.1`. MLflow will follow the redirect and return the target’s response content to the attacker.
This issue presents a full-read SSRF vulnerability against exposed MLflow instances. In cloud deployments, an attacker could attempt to retrieve instance metadata, temporary access tokens, IAM credentials, configuration values, or secrets accessible from the affected server’s network.
The risk is particularly severe if MLflow is internet-facing, runs without authentication, and has access to cloud-native metadata endpoints or internal management interfaces.
SSRF can turn an externally reachable machine learning operations platform into a proxy for reconnaissance and credential theft within an organization.
According to watchTowr, its Attacker Eye global honeypot network has observed exploitation attempts against cloud-hosted MLflow servers shortly after the CVE was assigned.
The reported activity focused on extracting credentials and secrets, highlighting that opportunistic scanning and exploitation are likely to increase.
MLflow version 3.15.0 addresses CVE-2026-64849. Security teams should immediately identify all MLflow deployments, including development, experimentation, and shadow MLOps environments, and upgrade any affected servers. The vulnerability advisory confirms that versions before 3.15.0 are at risk.
Defenders should also consider the following measures:
- Restrict public access to MLflow Tracking Server instances.
- Require authentication and place MLflow behind a reverse proxy or identity-aware access gateway.
- Review webhook configurations for unfamiliar or attacker-controlled URLs.
- Inspect application and proxy logs for requests to webhook test endpoints, redirect chains, metadata IP addresses, loopback ranges, and unusual outbound HTTP activity.
- Rotate cloud credentials or secrets potentially accessible to compromised MLflow hosts.
Organizations should treat any exposed MLflow servers running versions before 3.15.0 as potentially probed and conduct investigations for evidence of metadata service access or unauthorized secret retrieval.
Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world
