MLflow, the widely-used open-source platform for managing machine learning experiments and model registries, has a critical server-side request forgery (SSRF) vulnerability — CVE-2026-64849 — that attackers began exploiting within hours of the CVE being assigned on August 17, 2026. WatchTowr, which tracks the flaw, says its global honeypot telemetry is detecting active exploitation attempts targeting cloud-hosted MLflow instances. The attack reaches cloud metadata services (the internal IP addresses used by AWS, Azure, and GCP to expose instance credentials to applications) and exfiltrates those cloud credentials and secrets to attacker-controlled infrastructure.
The flaw lives in MLflow’s model-registry webhook feature. When a webhook request is made, MLflow follows web redirects without proper validation — allowing an attacker to redirect the request to internal network addresses, including the cloud metadata service at 169.254.169.254. The vulnerability bypasses prior fixes for similar issues in MLflow’s request handling. A separate critical flaw (CVE-2026-25895) in FUXA, an open-source SCADA/HMI platform used in industrial control systems, is also under active scanning as of August 18; VulnCheck detected a single IP broadly scanning for vulnerable FUXA instances and attempting to overwrite a core JavaScript file via path traversal.
How to check if you’re affected
Affected versions of MLflow are those running the model-registry webhook feature with the instance accessible from the public internet or from untrusted networks. Organizations should immediately check whether their MLflow deployment is publicly exposed, patch to the latest available version that addresses CVE-2026-64849, and rotate any cloud credentials (AWS IAM keys, service account tokens, Azure managed identity tokens) that may have been accessible to the MLflow process. Review MLflow audit logs for unexpected webhook calls, particularly those targeting private IP ranges.