The Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies that threat actors are now exploiting a critical MLflow vulnerability. MLflow is an open-source AI engineering platform for large language models (LLMs) and agents backed by the Linux Foundation, with over 30 million monthly downloads, used by thousands of organizations to debug, evaluate, optimize, and monitor AI applications. Tracked as CVE-2026-64849, this critical DNS-rebinding server-side request forgery (SSRF) bypass in MLflow's outbound webhook delivery was patched in version 3.15.0 and can be used by attackers without privileges to remotely access internal services or cloud metadata configurations on unpatched instances. "The default MLflow Tracking Server (mlflow server, no authentication, default SQLite backend) exposes the model-registry webhooks API unauthenticated, including a synchronous POST /api/2.0/mlflow/webhooks/{id}/test endpoint that returns the upstream response status and body to the caller," MLflow's security team says in a security advisory issued three weeks ago. "An unauthenticated attacker who can reach the tracking server makes the server issue HTTP requests to arbitrary internal/loopback/cloud-metadata endpoints and reads the responses via /test: cloud instance-metadata (e.g. AWS IMDS IAM credentials), internal-only admin services behind the network boundary, and internal port/host scanning." Successful exploitation can allow threat actors to steal cloud credenti...
CISA warns of hackers exploiting critical MLflow vulnerability
Affected Software
Frequently Asked Questions
Which MLflow deployments are vulnerable to this exploit?
Unpatched MLflow instances are affected, particularly the default MLflow Tracking Server configuration with no authentication and the default SQLite backend. In that configuration, the model-registry webhooks API and its test endpoint are exposed without authentication.
What can an attacker do by exploiting CVE-2026-64849?
An attacker without privileges who can reach an unpatched tracking server can use the DNS-rebinding SSRF bypass to make the server send HTTP requests to arbitrary destinations. This can enable remote access to internal services or cloud metadata configurations.
What remediation is identified in the article?
MLflow patched the vulnerability in version 3.15.0. Organizations running unpatched instances should move to the patched version.
Is exploitation confirmed?
Yes. CISA warned that threat actors are exploiting the vulnerability, and the issue was added to the Known Exploited Vulnerabilities catalog on August 22, 2026.