CISA Sets Sept. 2 Deadline to Patch, Amid Active Exploitation
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently highlighted a critical flaw in MLflow, a well-known platform favored by enterprises for managing machine learning models. This vulnerability enables attackers to exploit conscious weaknesses to target internal cloud services, thereby posing a significant threat to data security and privacy.
In a formal announcement, CISA included this flaw in its Known Exploited Vulnerabilities Catalog, setting a deadline for federal agencies to apply remediation measures by September 2. This decision underscores the gravity of the threat posed by the vulnerability, particularly given the increasing reliance on cloud-based infrastructures for storing sensitive information.
MLflow is equipped with a testing feature that verifies whether it can dispatch model updates to another service. During a normal operation, the receiving service responds, confirming the receipt of the sample message, which MLflow subsequently displays to the user who initiated the test. However, in the event of exploit, the situation turns precarious.
By default, an MLflow server allows any user with access to create a webhook and execute the test without requiring authentication. An attacker can exploit this by directing the webhook to a controlled website, initiating the testing process. The website, in turn, redirects MLflow to a service buried within the company’s own cloud environment. Although the attacker lacks direct access to this service, the MLflow server can reach it. In an alarming breach of trust, MLflow will follow this redirect without verifying the endpoint’s authenticity and will process the information received, ultimately exposing this data in the test results.
This exploitation method allows attackers to intercept crucial information, particularly if the target resides within a cloud metadata service. In such instances, the extracted results could potentially encompass sensitive credentials, granting access to various other cloud resources.
This vulnerability belongs to a category known as Server-Side Request Forgery (SSRF). SSRF vulnerabilities permit an attacker to induce an affected server to retrieve data on their behalf without authorization. The specific flaw has been cataloged under the identifier CVE-2026-64849, a designation that has sparked concern among security experts due to its apparent ease of exploitation.
Research conducted by security experts managed to reproduce this flaw, specifically in MLflow version 3.13.0, demonstrating the potential hazard by accessing test data from a local service. It is crucial to note that while this demonstration effectively illustrated the vulnerability’s mechanics, it did not involve a cloud deployment or conclusively prove that an actual organization had suffered from an intrusion.
However, CISA’s advisories revealed alarming evidence indicating that this vulnerability was presently being exploited in the wild. Additional insights from WatchTowr, a security firm, noted that its honeypots detected widespread scanning activities targeting exposed MLflow servers just hours after the Common Vulnerabilities and Exposures (CVE) designation was published. Not only were attempts against cloud-hosted installations reported, but attackers also managed to extract valuable credentials and secrets from cloud metadata services.
The severity of the security breach is contingent upon the level of access allowed to the compromised cloud identity. Robbie Mueller, a solutions engineer at ArmorCode, emphasized this perspective by stating that if attackers gain access to credentials associated with an excessively privileged cloud identity, it could escalate exploitation of MLflow into a much more extensive security incident, allowing attackers to pivot across the network.
Compounding the challenge, many organizations may wrestle with the task of identifying all vulnerable installations of MLflow. The platform’s versatility means it can be used across different phases such as development, research, and production. However, existing company asset records may fall short in accurately cataloging each deployment or revealing whether these installations are accessible via the internet, raising concerns over unattended vulnerabilities.
To address the critical issues posed by this vulnerability, MLflow has released version 3.15.0, incorporating necessary patches aimed at mitigating the risks associated with the exploitation of this flaw. Organizations utilizing MLflow are urged to stay proactive and ensure that their deployments are updated to safeguard against potential breaches, as the landscape of cybersecurity threats continues to evolve rapidly.