# Critical Vulnerability in MLflow Exploited for Credential Theft

*Published August 19, 2026*
*Source: [https://cybersecuritynews.com/mlflow-ssrf-vulnerability/](https://cybersecuritynews.com/mlflow-ssrf-vulnerability/)*

## Executive Summary

A critical SSRF vulnerability in MLflow, CVE-2026-64849, is being actively exploited, allowing attackers to steal cloud credentials and sensitive data. Immediate action is required to update to MLflow version 3.15.0 to mitigate this risk.

## Article

Cybersecurity experts have identified an active exploitation of a critical SSRF vulnerability in MLflow, a widely used platform in the machine learning community. This flaw, designated as CVE-2026-64849, carries a severe CVSS score of 9.3 and affects all MLflow versions before 3.15.0. The vulnerability allows attackers to harvest cloud credentials and sensitive deployment tokens from exposed MLflow instances.

The threat was first observed by watchTowr Intel, which noted that attackers began targeting vulnerable MLflow systems almost immediately after the vulnerability was made public. The issue stems from the MLflow Tracking Server's lack of mandatory authentication and its reliance on a local SQLite backend, which leaves the model-registry webhooks API exposed to potential threats.

The vulnerability is primarily exploited through an unauthenticated POST request to a specific API endpoint, which returns the full upstream HTTP status code and response body to the requester. This transforms a simple request-forgery into a powerful tool for data extraction. Although MLflow attempted to address this in version 3.10.0, their solution only checked initial request destinations and failed to account for HTTP redirects, leaving the system open to further attacks.

This flaw is particularly concerning for users of major cloud services such as AWS, Azure, and Google Cloud Platform, as it can lead to the extraction of sensitive information like IAM credentials and OAuth tokens from cloud metadata services. In response, the developers have fixed the issue in MLflow version 3.15.0, and it is crucial for organizations to update their systems immediately. Additional steps include auditing access logs, rotating credentials, and implementing network egress filtering to safeguard against unauthorized data access.