Attackers slipped through an unnoticed entry point in cloud environments, and the breach went completely unnoticed until the fallout began compounding.
Backed by the Linux Foundation, MLflow serves as an open-source framework utilized by countless enterprises to handle machine learning lifecycles, racking up 60 million monthly pulls. Because teams often view it merely as a tool for local AI experimentation, they frequently overlook its security. That assumption is dangerously flawed.
August 17 marked the disclosure of CVE-2026-64849, a severe server-side request forgery (SSRF) flaw. Merely two days later on August 19, CISA slotted the bug into its Known Exploited Vulnerabilities registry, signaling that malicious actors were already actively leveraging the exploit in real-world scenarios.
The attack methodology is straightforward. Malicious actors scan for accessible MLflow deployments running anything older than version 3.15.0, which lack any access controls or login requirements. They transmit a meticulously engineered payload to the webhook interface.
Although the query appears harmless on the surface, MLflow parses it and (instead of normal execution) queries the underlying cloud provider’s metadata service. That specific URL houses sensitive credentials: short-lived AWS keys, GCP service accounts, and Azure managed identities. In short, everything necessary to compromise an entire cloud footprint.
Security analysts at watchTowr observed these incursions as they unfolded via deployed honeypots. Shortly after the CVE designation went public, their sensors detected automated sweeps hunting for vulnerable MLflow endpoints. The perpetrators demonstrated precise knowledge of their targets.
“Attackers are exploiting the vulnerability to reach cloud metadata services directly, and exfiltrating cloud credentials and secrets,” watchTowr said. “If your organization runs MLflow, prioritize patching any exposed systems, review audit logs for signs of compromise, and check whether sensitive credentials may have been exposed.”
Once authentication tokens are in hand, the escalation moves rapidly. Honeypot telemetry indicates that bad actors leverage the stolen secrets to map out cloud assets, spin up illicit crypto miners, provision fresh IAM identities for long-term access, and plant backdoors. A single neglected MLflow node effectively compromises the whole perimeter.
The threat level is exceptionally high due to the lack of authentication barriers. Attackers bypass the need for valid credentials or prior system compromises. Finding a public-facing MLflow installation is all it takes, and the exploitation is instantaneous. By the time administrators notice anomalies, unauthorized coin mining or data leakage is already well underway.
A remedy is available in MLflow 3.15.0, which resolves the flaw, making immediate patching essential. Although CISA mandated a 14-day remediation window for federal agencies, that leaves a fortnight of active, unmitigated threat exposure across the broader digital landscape.
The root issue lies in visibility, as many companies remain entirely unaware that MLflow is active in their stack. Often pulled in as a background dependency or running silently on internal networks, it routinely escapes standard vulnerability tracking. Consequently, organizations usually remain oblivious to the exposure until suspicious cloud bills for crypto mining or sudden data outflows reveal the breach.
