Vulnerabilities in AI and machine learning platforms

Security researchers have identified significant vulnerabilities within open-source platforms used for artificial intelligence and machine learning workflows.

Initial findings disclosed six remote-code-execution (RCE) vulnerabilities in Flowise, an open-source platform for building AI agents. These flaws, affecting versions 3.1.1 and 3.1.2, could allow authenticated users to run arbitrary commands on host servers, potentially compromising credentials and connected business tools. Additionally, a scan of the public internet revealed approximately 37,000 exposed Baseboard Management Controllers (BMCs) using the IPMI 2.0 protocol, many of which were vulnerable to an authentication flaw that allows attackers to control server power and firmware.

Subsequently, threat actors were found actively exploiting a critical unauthenticated server-side request forgery (SSRF) vulnerability in MLflow, a platform for machine learning and data engineering. Identified as CVE-2026-64849, the flaw allows attackers to bypass security fixes via HTTP redirects to exfiltrate sensitive cloud credentials and deployment tokens. The vulnerability is noted for its high impact, as it enables a ‘full-read primitive’ by reflecting upstream HTTP status codes and response bodies.