MLflow SSRF vulnerability exploited to steal cloud credentials

Threat actors are actively exploiting a critical unauthenticated server-side request forgery (SSRF) vulnerability in MLflow, a widely used open-source platform for machine learning and data engineering. The flaw, identified as CVE-2026-64849 with a CVSS score of 9.3, affects all versions prior to 3.15.0.

Security researchers from watchTowr and VulnCheck report that attackers began scanning for internet-exposed MLflow instances within hours of the vulnerability's public disclosure. The exploit targets the model-registry webhooks API, allowing attackers to bypass previous security fixes by abusing HTTP redirects. By redirecting requests to internal cloud metadata services or loopback interfaces, adversaries can exfiltrate sensitive cloud credentials, deployment tokens, and other secrets.

The vulnerability is particularly high-impact because the affected endpoint reflects full upstream HTTP status codes and response bodies, transforming a standard blind request-forgery into a full-read primitive. Organizations using MLflow are urged to update to version 3.15.0 or later to mitigate the risk.