CISA Adds Critical MLflow SSRF Vulnerability (CVE-2026-64849) to Known Exploited Vulnerabilities Catalog
Executive Summary
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Server-Side Request Forgery (SSRF) vulnerability affecting the open-source machine learning lifecycle management platform MLflow (CISA Alert (August 19, 2026)) to its Known Exploited Vulnerabilities (KEV) Catalog. Tracked as CVE-2026-64849, the vulnerability is actively exploited by threat actors to breach cloud AI infrastructure, exfiltrate IAM role credentials, and access internal cloud services. Under Binding Operational Directive (BOD) 26-04, federal civilian agencies must remediate this flaw rapidly.
Deep-Dive Technical Analysis
Vulnerability Mechanism & Cloud Metadata Exploitation
MLflow is widely deployed across enterprise data science and MLOps teams to track model experiments, manage artifacts, and deploy machine learning models. The vulnerability resides in insufficient input validation within MLflow's model artifact and dataset loading endpoints:
1. Unauthenticated SSRF Sink: Remote attackers transmit crafted HTTP requests containing internal network URLs to MLflow artifact management APIs.
2. Cloud Metadata Service Targeting (IMDS): Attackers point the SSRF request to cloud Instance Metadata Services (such as AWS IMDSv1 at http://169.254.169.254/latest/meta-data/iam/security-credentials/ or GCP metadata endpoints).
3. Credential Harvesting & IAM Role Compromise: The MLflow server fetches the internal metadata and reflects temporary security tokens, allowing the attacker to assume the host machine's cloud IAM role.
4. Internal Network & Model Storage Pivoting: Attackers leverage the stolen IAM role permissions to list and exfiltrate proprietary machine learning model weights, training datasets, and S3/GCS bucket contents.
Federal Mandate & BOD 26-04 Compliance
CISA's directive requires Federal Civilian Executive Branch (FCEB) agencies to prioritize the remediation of CVE-2026-64849 on publicly exposed systems, establishing strict verification protocols to determine whether systems were compromised prior to patch installation.
AI Pipeline & MLOps Threat Landscape
As organizations operationalize generative AI and machine learning models, open-source AI orchestration frameworks (such as MLflow, Langflow, and Ollama) have become prime targets for automated exploit campaigns. Because MLOps platforms frequently run with elevated cloud storage and compute permissions, compromising an MLflow server provides attackers a high-privilege gateway to sensitive enterprise intellectual property.
Actionable Recommendations & Mitigations
1. Upgrade MLflow: Update MLflow instances to the latest patched release immediately.
2. Enforce IMDSv2 & Hop Limits: On AWS EC2 instances running MLflow, require IMDSv2 (token-based session headers) and configure the metadata response hop limit to 1 to prevent containerized SSRF requests from reaching the metadata service.
3. Isolate MLOps Infrastructure: Remove MLflow tracking servers from direct public internet exposure. Restrict access behind an authenticated reverse proxy or corporate VPN/ZTNA gateway.
4. Principle of Least Privilege for IAM Roles: Restrict cloud IAM policies attached to MLOps compute instances, ensuring they cannot read unrelated storage buckets or administer cloud accounts.
5. Audit CloudTrail & Access Logs: Inspect cloud provider API logs for anomalous calls originating from MLflow instance role credentials.
________________
Sources & References: CISA Known Exploited Vulnerabilities Catalog Alert, The Hacker News.