Attackers Exploit MLflow and FUXA Flaws to Steal Cloud Secrets
Critical SSRF in MLflow and data disclosure bugs in FUXA industrial software are being actively exploited to extract credentials and OT configurations.
Cyber attackers are actively exploiting critical vulnerabilities in MLflow and FUXA to extract sensitive cloud credentials and industrial configurations. These flaws allow unauthenticated remote actors to bypass security guards and access internal data, posing a severe risk to both cloud-native AI pipelines and industrial automation environments.
In MLflow, a critical unauthenticated server-side request forgery (SSRF) vulnerability, tracked as CVE-2026-64849, affects all versions prior to 3.15.0. The flaw resides in the model-registry webhook testing functionality, specifically the `/api/2.0/mlflow/webhooks/{id}/test` endpoint, which reflects the response body of upstream requests. Attackers bypass the `_validate_webhook_url` guard by providing a public URL that triggers a 302 redirect to internal resources, such as the local loopback address (127.0.0.1) or cloud metadata services at 169.254.169.254.
Industrial Automation Risks
Simultaneously, vulnerabilities in FUXA, an open-source web-based SCADA/HMI software used for industrial automation, have been identified as CVE-2026-47717 and CVE-2026-47718. These flaws allow guest or unauthenticated users to read project, alarms, and scheduler APIs in version 1.3.0. Critically, these data disclosure vulnerabilities persist even when the `secureEnabled=true` setting is active, leaving industrial operational technology (OT) exposed to unauthorized reconnaissance.
Impact on Cloud and OT Infrastructure
The implications of the MLflow vulnerability are particularly acute for organizations utilizing major cloud providers like AWS, Azure, and GCP. By accessing the cloud metadata service, attackers can steal IAM roles and OAuth tokens, which may grant them broad administrative access to the entire cloud environment. Security reports indicate that attackers are already targeting cloud-hosted MLflow systems to extract these secrets via global honeypot networks.
For FUXA users, the exposure of project configurations and scheduler data provides a blueprint of industrial processes. This level of detail can be leveraged by threat actors to facilitate highly targeted attacks against physical infrastructure and critical control systems.
Remediation and Outlook
Administrators must update MLflow to version 3.15.0 or later to patch the SSRF flaw. For FUXA deployments, security teams should audit API access and monitor for unauthorized requests to project and scheduler endpoints. Because these tools are frequently deployed in internal environments with high-level privileges, the ability for an unauthenticated attacker to pivot from a web interface to internal metadata services represents a significant escalation in attack surface. Security professionals should prioritize the rotation of any cloud credentials that may have been exposed via metadata services during the exploitation window.