CISA Warns of Active Exploitation of Critical MLflow Flaw
Summary
CISA says attackers are exploiting CVE-2026-64849, an unauthenticated MLflow webhook SSRF flaw that can expose internal services and cloud metadata. MLflow patched it in version 3.15.0; federal agencies have two weeks to patch.
Key points
- CISA added CVE-2026-64849 to its catalog of vulnerabilities exploited in the wild.
- The DNS-rebinding SSRF bypass affects MLflow’s outbound webhook delivery and can be triggered without authentication on reachable tracking servers.
- The vulnerable webhook test endpoint can return responses from internal services and cloud-metadata endpoints, potentially exposing AWS IAM credentials.
- MLflow patched the vulnerability in version 3.15.0.
- CISA ordered U.S. federal agencies to secure affected MLflow instances within two weeks and urged other network defenders to prioritize patching.
Article Details
- Vulnerability Types
- DNS-rebinding server-side request forgery (SSRF) bypass
- Severity
- Critical
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
T1046 · Network Service DiscoveryThe vulnerability can be used to scan internal ports and hosts.T1190 · Exploit Public-Facing ApplicationAttackers exploit CVE-2026-64849 in MLflow's webhook delivery to access a vulnerable tracking server without authentication.T1552.005 · Cloud Instance Metadata APIThe SSRF flaw can reach AWS instance metadata and expose IAM credentials.