Security Flaw Exposed in MLflow: Urgent Response Required

A significant security vulnerability, identified as CVE-2026-64849, has been discovered in MLflow, a widely used platform for managing the machine learning lifecycle. This vulnerability is particularly alarming as it is currently being exploited by attackers just hours following its announcement, as highlighted by cybersecurity firm watchTowr.

The flaw specifically targets MLflow versions preceding 3.15.0, posing a substantial risk of exposing sensitive information such as cloud credentials and internal services to remote attackers. The security implications of this vulnerability are considerable, potentially compromising the integrity of organizations using the platform.

Overview of the MLflow SSRF Vulnerability

The root of the SSRF (server-side request forgery) flaw lies in MLflow’s model-registry webhook testing functionality. A default MLflow Tracking Server exposes a POST endpoint, /api/2.0/mlflow/webhooks/{id}/test, which does not require authentication. This oversight allows any individual to trigger webhook deliveries and subsequently view the response status and body from the upstream server, making it an easy target for exploitation.

To mitigate risks, MLflow introduced outbound destination validation in version 3.10.0, aimed at preventing webhooks from reaching private IP addresses. However, the validation only applies to the initially provided hostname. Once the webhook delivery logic follows HTTP redirects, it fails to re-validate the destination or maintain a secure link with the originally validated IP address.

An attacker could easily create a public HTTPS endpoint that meets this initial validation criterion and then utilize an HTTP 302 redirect to redirect requests to sensitive targets, including the link-local address http://169.254.169.254/, typically associated with cloud metadata services, or internal endpoints like 127.0.0.1. By following the redirect, MLflow inadvertently exposes internal data to the attacker.

Exploitation Risks

The implications of this vulnerability are severe, particularly in cloud deployments. An attacker could exploit this SSRF flaw to gain access to critical instance metadata, temporary access tokens, IAM credentials, and various other configuration values or secrets that may reside within the affected server’s network. The risk is exacerbated when MLflow is exposed directly to the internet, lacks sufficient authentication measures, and has access to cloud-native metadata endpoints or internal management interfaces.

Importantly, SSRF vulnerabilities can effectively transform a publicly reachable machine learning operations platform into a proxy for reconnaissance and credential theft, significantly magnifying the risk of internal data breaches.

Ongoing Exploitation Activity

According to watchTowr’s Attacker Eye global honeypot network, there has been a noticeable uptick in attempts to exploit this vulnerability against cloud-hosted MLflow servers shortly after the CVE assignment. Reports indicate a concentrated focus on extracting sensitive credentials and secrets, suggesting that opportunistic scanning and exploitation tactics by attackers may surge in the coming days.

Organizations utilizing MLflow should urgently transition to version 3.15.0 or later, which effectively addresses the CVE-2026-64849 vulnerability. Security teams are advised to promptly identify all MLflow deployments—encompassing development, experimental, and hidden MLOps environments—and ensure that any affected servers are upgraded without delay.

Recommendations for Mitigation

In addition to updating to the secured version, security professionals are encouraged to adopt the following defensive measures:

1. Restrict Public Access: Limit exposure of MLflow Tracking Server instances to public networks as much as possible.

2. Implement Authentication: Mandate authentication access and place MLflow behind a reverse proxy or identity-aware access gateway to enhance security.

3. Review Webhook Configurations: Regularly check webhook configurations for unfamiliar or potentially malicious URLs.

4. Monitor Logs: Scrutinize application and proxy logs for unusual activities linked to webhook test endpoints, redirect chains, and requests related to metadata IP addresses.

5. Rotate Credentials: Periodically refresh cloud credentials or secrets that may be accessible to compromised MLflow hosts.

Organizations must treat any exposed MLflow servers running versions before 3.15.0 as potentially compromised and should investigate any evidence of unauthorized access to metadata services or secret retrieval.

In conclusion, the rapid spread and exploitation of CVE-2026-64849 underscore the critical need for immediate action from organizations using MLflow. Addressing this vulnerability is paramount to safeguarding sensitive data and maintaining organizational security.

Source link