LIVE FEED
CRITICAL CVE-2026-64849: MLflow SSRF Exploited to Steal Cloud Credentials // HIGH CoSnitch Attack Forces Copilot to Expose Its Own Architecture // FIRST LOOK OpenAI Adds Chain-of-Thought Monitoring to Astra Safety Controls // HIGH Shostack's LLM Threat Model Responds to Hugging Face Attack // HIGH Naming Error Lets Anthropic AI Models Attack Real Company // HIGH Israel-Linked Fake Think Tank Targets LLM Training Data // CRITICAL GitHub Copilot Autofix Introduced CI/CD Injection in Snowflake // CRITICAL Claude Agents Create Self-Replicating Malware in Turf War // FIRST LOOK Anthropic MCP Server Security Risks and Secrets Exposure Explained // HIGH OpenAI Disbands Preparedness Team Amid IPO Safety Concerns //
ATLAS OWASP CRITICAL Active exploitation · Immediate action required LLM Security Supply Chain Industry News RELEVANCE ▲ 8.5

CVE-2026-64849: MLflow SSRF Exploited to Steal Cloud Credentials

SOURCE The Hacker News ↗
TL;DR CRITICAL
  • What happened: Attackers actively exploit MLflow SSRF flaw to steal cloud credentials via metadata endpoints.
  • Who's at risk: Any organisation running internet-exposed MLflow Tracking Servers below version 3.15.0 is directly at risk of credential and secret exfiltration.
  • Act now: Patch MLflow to version 3.15.0 or later immediately · Review audit logs for unexpected outbound requests to internal metadata IP ranges · Rotate any cloud credentials and secrets accessible from affected MLflow servers
CVE-2026-64849: MLflow SSRF Exploited to Steal Cloud Credentials

Overview

Two critical vulnerabilities in widely-used open-source platforms are under active exploitation as of mid-August 2026. The more significant from an AI infrastructure perspective is CVE-2026-64849, a CVSS 9.3-rated unauthenticated Server-Side Request Forgery (SSRF) flaw in MLflow — one of the most widely deployed open-source platforms for managing the machine learning lifecycle. Exploitation was observed within hours of the CVE being formally assigned on 17 August 2026, with threat intelligence firm watchTowr confirming malicious scanning via its global honeypot telemetry.

The second vulnerability, CVE-2026-25895 (CVSS 9.5), affects FUXA, a web-based SCADA/HMI platform used in operational technology environments, and enables unauthenticated remote code execution via path traversal and missing authentication controls.

Technical Analysis

CVE-2026-64849 exploits a flaw in MLflow’s model-registry webhook handling. An attacker with network access to an exposed MLflow Tracking Server can craft requests that cause the server to proxy HTTP requests to arbitrary internal endpoints — including cloud metadata services (e.g., http://169.254.169.254/ on AWS, GCP, and Azure). The vulnerability bypasses prior remediation attempts due to improper handling of HTTP redirects, allowing attackers to reach internal services that would otherwise be inaccessible from the public internet.

WatchTowr principal threat intelligence specialist Yordan Ganchev confirmed that adversaries are actively targeting cloud-hosted MLflow deployments to extract temporary cloud credentials, IAM tokens, and other secrets from internal metadata APIs. Once credentials are obtained, lateral movement within the victim’s cloud environment is trivial.

For CVE-2026-25895, VulnCheck observed a single IP address conducting broad internet scans for exposed FUXA instances from 18 August 2026. The observed payloads attempt to overwrite main.js with junk data; no remote code execution payloads have been dropped as of reporting time, though approximately 60 FUXA instances are publicly exposed.

Framework Mapping

MITRE ATLAS:

  • AML.T0040 (AI Model Inference API Access): Attackers are abusing MLflow’s Tracking Server API as a pivot point to reach internal infrastructure.
  • AML.T0083 (Credentials from AI Agent Configuration): The end goal of the SSRF chain is extraction of cloud credentials accessible to the ML platform’s runtime environment.
  • AML.T0047 (AI-Enabled Product or Service): MLflow as a deployed AI lifecycle service is the direct attack surface.

OWASP LLM Top 10:

  • LLM05 (Supply Chain Vulnerabilities): MLflow is core infrastructure for many ML pipelines; compromise cascades into model training and deployment environments.
  • LLM06 (Sensitive Information Disclosure): Cloud credentials and secrets are the primary exfiltration target.

Impact Assessment

Organisations running MLflow versions below 3.15.0 in cloud environments are at immediate, critical risk. The SSRF attack chain requires only network reachability to the Tracking Server — no authentication is needed. Successfully exfiltrated cloud credentials can enable full account takeover, data exfiltration, and persistent access to ML pipelines, training data stores, and model registries. The rapid exploitation timeline (hours after CVE assignment) indicates organised, opportunistic threat actors are actively scanning at scale.

Mitigation & Recommendations

  1. Patch immediately: Upgrade MLflow to version 3.15.0 or later. Treat this as emergency priority for all internet-exposed instances.
  2. Restrict network access: Place MLflow Tracking Servers behind VPN or internal-only networks; remove public internet exposure.
  3. Review audit logs: Search for anomalous outbound requests to 169.254.169.254 or equivalent cloud metadata endpoints.
  4. Rotate credentials: Assume any cloud credentials accessible to affected MLflow instances may be compromised; rotate immediately.
  5. Apply IMDSv2 enforcement: On AWS, enforce IMDSv2 to add a layer of SSRF mitigation at the cloud platform level.
  6. Monitor for FUXA exposure: If running FUXA ≤ 1.2.9, apply vendor patches or remove public internet exposure immediately.

References

◉ AI THREAT BRIEFING

Stay ahead of the threat.

Twice-weekly digest of critical AI security developments — every story mapped to MITRE ATLAS and OWASP LLM Top 10. Free.

No spam. Unsubscribe anytime.