MLflow SSRF Exploited for Cloud Credential Theft Within Hours of CVE Assignment (CVE-2026-64849)

Internet-exposed MLflow Tracking Servers, the experiment-tracking and model-registry component in most enterprise ML pipelines

CVE-2026-64849 (CVSS 9.3) is an unauthenticated server-side request forgery in MLflow's model-registry webhooks, reachable through a POST to `/api/2.0/mlflow/webhooks/{id}/test`, which lets anyone who can reach the Tracking Server make it issue HTTP requests to arbitrary internal endpoints including cloud instance metadata services and return the results. All versions before 3.15.0 are affected. watchTowr's Attacker Eye honeypot network observed indiscriminate scanning for exposed MLflow instances within hours of the CVE being assigned, with financially motivated actors and initial access brokers harvesting cloud provider credentials, API tokens, and deployment secrets for monetization, lateral movement, and resale. CISA added the flaw to the Known Exploited Vulnerabilities catalog on August 19, 2026 with a federal patching deadline of September 2. A default MLflow Tracking Server runs with no mandatory authentication on a local SQLite backend, so the webhooks API is routinely exposed to untrusted traffic in ordinary deployments

An unauthenticated webhook test endpoint that performs server-side fetches of caller-supplied URLs, on a service whose defaults assume a trusted network. The AI-specific consequence is what the SSRF reaches: an MLflow server usually sits inside the cloud role that owns the training data, the model registry, and the deployment pipeline