Critical MLflow SSRF Flaw CVE-2026-64849 Exploited in Cloud Attacks

Threat actors are actively targeting cloud-hosted MLflow deployments following the disclosure of CVE-2026-64849, an unauthenticated server-side request forgery (SSRF) vulnerability affecting MLflow versions prior to 3.15.0.

Security researchers have reported exploitation attempts shortly after the vulnerability was assigned, indicating that attackers are rapidly scanning the internet for exposed MLflow instances and attempting to exploit vulnerable deployments.

According to watchTowr Intel, its Attacker Eye global honeypot network observed exploitation activity within hours of the CVE being assigned.

Critical MLflow SSRF Flaw

The speed of the attacks highlights how quickly threat actors can operationalize newly disclosed vulnerabilities, particularly when affected applications are commonly deployed in cloud environments.

Organizations exposing MLflow services directly to the internet could therefore face elevated risks if vulnerable installations remain unpatched.

SSRF vulnerabilities allow attackers to manipulate a vulnerable server into sending HTTP requests to destinations selected by the attacker.

This capability becomes particularly dangerous in cloud environments because an application may have network access to services that are inaccessible from the public internet.

Attackers can potentially use SSRF vulnerabilities to probe internal systems, interact with private APIs, and target cloud metadata endpoints.

Cloud metadata services are especially valuable targets because they can expose temporary credentials associated with compute workloads.

Depending on the cloud platform and configuration, attackers may attempt to obtain identity tokens, access keys, service-account credentials, or other authentication material.

If the compromised MLflow server operates with excessive permissions, successful exploitation could potentially provide access to additional cloud resources.

The risk is significant because MLflow deployments can be positioned near sensitive machine-learning infrastructure. Organizations frequently use MLflow to manage experiments, models, artifacts, training workflows, and deployment processes.

A compromised server could potentially provide attackers with a pathway toward model repositories, object storage, source-code systems, CI/CD infrastructure, internal APIs, or production machine-learning services.

Security teams should therefore treat internet-facing MLflow installations running vulnerable versions as urgent patching candidates.

Organizations should upgrade to MLflow 3.15.0 or later and verify that vulnerable deployments are no longer externally accessible where public exposure is unnecessary.

Network segmentation and restrictive outbound firewall policies can also reduce the potential impact of SSRF exploitation.

Organizations should additionally investigate their security telemetry for signs of exploitation. Relevant indicators may include unexpected outbound connections from MLflow servers, requests targeting cloud metadata endpoints, communication with private IP addresses, unusual DNS activity, and unexpected interactions with internal APIs or secret-management systems.

Patching should not be considered sufficient if exploitation may have occurred before remediation. Security teams should review cloud audit logs, authentication records, application logs, and network telemetry for suspicious activity.

If credentials, access tokens, temporary identities, or application secrets may have been exposed, they should be revoked and rotated immediately.

Organizations should also review IAM policies and remove unnecessary privileges to limit potential lateral movement.

The rapid exploitation of CVE-2026-64849 demonstrates the growing security challenges surrounding cloud-based machine-learning infrastructure.

As ML platforms become increasingly integrated with sensitive data and production systems, organizations must treat them as critical infrastructure and apply the same vulnerability management, monitoring, identity security, and network segmentation controls used for other high-value enterprise services.