Threat actors have been exploiting a recent MLflow vulnerability to steal sensitive information, including credentials and secrets.
An open source AI engineering platform, MLflow allows users to manage the end-to-end machine learning lifecycle and deploy AI agents, LLMs, and ML models in production. It has over 27,000 GitHub stars and more than 60 million monthly downloads.
Tracked as CVE-2026-64849 (CVSS score of 9.3), the exploited security defect is described as an unauthenticated server-side request forgery (SSRF) issue that allows attackers to send HTTP requests to internal endpoints.
The issue exists because the default MLflow Tracking Server (mlflow server) exposes the model-registry webhooks API without authentication, according to MLflow’s advisory.
One of the exposed endpoints would return the upstream response status and body to the caller, and an SSRF protection that was added in version 3.10.0 could be bypassed.
“Attackers are exploiting the vulnerability to reach cloud metadata services directly and exfiltrate cloud credentials and secrets,” attack surface management firm WatchTowr warns.
According to the company, in-the-wild exploitation started within hours of CVE assignment, targeting cloud-hosted instances.
“All MLflow versions before 3.15.0 are affected. If your organization runs MLflow, prioritize patching any exposed systems, review audit logs for signs of compromise, and check whether sensitive credentials may have been exposed,” WatchTowr says.
On Wednesday, the US cybersecurity agency CISA added CVE-2026-64849 to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch it within two weeks, in line with BOD 26-04’s recommendations.
Related: Cisco Patches Critical Crosswork, Secure Workload Vulnerabilities
Related: Critical GitLab Flaw Exploited Shortly After Disclosure
Related: Exploitation Expected for Critical Authentication Bypass Patched in Citrix NetScaler
Related: Chrome, Firefox Updates Patch Dozens of Vulnerabilities