Executive Summary
A critical Server-Side Request Forgery (SSRF) vulnerability in MLflow, tracked as CVE-2026-64849 with a CVSS score of 9.3, is currently being actively exploited in the wild to target cloud-hosted machine learning infrastructure. Disclosed on August 17–18, 2026, the vulnerability enables unauthenticated remote attackers to bypass internal SSRF validation filters and force MLflow tracking servers to proxy requests into internal cloud metadata services (such as AWS IMDS, Google Cloud Metadata, and Azure IMDS). Threat intelligence monitors from watchTowr and VulnCheck detected global automated scanning and exploitation within hours of the CVE assignment. Because default MLflow deployments often run unauthenticated with elevated cloud IAM roles, this flaw provides adversaries with direct access to sensitive cloud credentials, model registries, and proprietary dataset repositories.
Deep-Dive Technical Analysis
MLflow is one of the most widely adopted open-source platforms for managing the end-to-end machine learning lifecycle, including experiment tracking, model registry, and artifact deployment.
1. Root Cause & Architectural Breakdown
In MLflow version 3.10.0, developers introduced an SSRF protection mechanism within mlflow/utils/validation.py (_validate_webhook_url()). This function resolves the target webhook's hostname at configuration time and validates that the resolved IP does not fall within private (RFC 1918), loopback (127.0.0.0/8), or link-local (169.254.0.0/16) address spaces.
However, security researchers discovered a critical architectural flaw in the webhook delivery engine (mlflow/webhooks/delivery.py). When dispatching test notifications or event triggers, the HTTP client follows standard HTTP redirects without enforcing allow_redirects=False or re-validating the destination IP address after each redirect step.
2. Exploitation Mechanics
1. Initial Validation Bypass: An attacker creates a webhook pointing to an attacker-controlled public HTTPS endpoint (e.g., https://attacker.com/webhook). Because attacker.com resolves to a public routable IP address, it passes the _validate_webhook_url() filter.
2. HTTP 302 Redirection to Metadata Endpoints: When MLflow invokes the webhook, the attacker's server responds with an HTTP 302 Found or 307 Temporary Redirect header pointing directly to the internal link-local metadata address:
Location: http://169.254.169.254/latest/meta-data/iam/security-credentials/
3. Full Response Reflection: Unlike blind SSRF vulnerabilities, MLflow’s unauthenticated testing endpoint (POST /api/2.0/mlflow/webhooks/{id}/test) captures the full upstream HTTP response status, headers, and body, reflecting the data directly back to the caller. This allows the attacker to immediately harvest temporary AWS security credentials (AccessKeyId, SecretAccessKey, and Token) or instance service account tokens in plaintext within the API response.
Industry Impact & Threat Landscape
The rapid deployment of MLOps pipelines by data science teams often bypasses standard enterprise perimeter hardening. MLflow tracking servers are frequently deployed in public-facing subnets with default unauthenticated configurations, yet assigned broad cloud permissions (such as Amazon S3 full access for training data or Amazon SageMaker execution roles).
Exploitation of CVE-2026-64849 gives adversaries immediate footholds into enterprise cloud environments, allowing:
* Exfiltration of proprietary machine learning weights and intellectual property.
* Data poisoning attacks against model training datasets.
* Lateral movement across cloud accounts using harvested IAM credentials.
Mitigation & Actionable Recommendations
1. Immediate Upgrade: Upgrade all MLflow instances to MLflow version 3.15.0 or later, which enforces strict redirect handling and re-pins IP addresses across all outbound webhook delivery requests.
2. Enforce IMDSv2 with Hop-Limit Restrictions: On AWS EC2 and containerized workloads, require Instance Metadata Service Version 2 (IMDSv2) and configure the HTTP hop limit to 1:
aws ec2 modify-instance-metadata-options --instance-id
This prevents containerized or proxied applications from reaching the link-local metadata endpoint.
3. Enable MLflow Authentication & Network Isolation: Place all MLflow tracking servers behind reverse proxies with strict authentication (OAuth/SSO), and restrict outbound egress traffic from MLflow hosts using security groups to block connections to private RFC 1918 and link-local address spaces.
4. Credential Rotation & IAM Auditing: Review cloud audit logs (AWS CloudTrail, GCP Cloud Audit Logs) for unauthorized calls originating from MLflow instance identities, and immediately rotate any IAM credentials or access keys associated with exposed MLflow host instances.