CISA Warns of Critical MLflow Vulnerability Being Exploited in the Wild

The Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability in the MLflow AI engineering platform to its Known Exploited Vulnerabilities (KEV) catalog. The flaw, tracked as CVE-2026-64849, allows unauthenticated attackers to bypass security controls to access internal services and sensitive cloud metadata.

According to CISA and security researchers, the vulnerability is a DNS-rebinding and HTTP redirect server-side request forgery (SSRF) bypass located in MLflow's outbound webhook delivery mechanism. By exploiting this flaw, threat actors can force the MLflow server to issue HTTP requests to internal, loopback, or cloud-metadata endpoints and read the resulting responses. The vulnerability has been patched in MLflow version 3.15.0. Due to the severity of the risk, U.S. Federal Civilian Executive Branch (FCEB) agencies have been ordered to patch their instances within two weeks under Binding Operational Directive 26-04.

The AI Infrastructure Risk

MLflow is a widely adopted open-source platform used by organizations to debug, evaluate, and monitor AI applications. The vulnerability specifically impacts the default MLflow Tracking Server when it is operated without authentication and utilizes the default SQLite backend, which exposes the model-registry webhooks API to the public internet. Because many AI development pipelines prioritize rapid deployment over strict security configurations, these default settings are common in many environments.

Implications for Cloud Security

This vulnerability is particularly dangerous because it provides a direct path to cloud infrastructure compromise. Security researchers report that attackers are exploiting the flaw to reach cloud metadata services directly to exfiltrate secrets and cloud credentials. Specifically, threat actors can steal AWS Identity and Access Management (IAM) credentials from instance-metadata services. Once these credentials are stolen, an attacker can pivot from a single AI tool to full administrative control over a company's cloud environment.

Next Steps for Operators

Organizations using MLflow are urged to update to version 3.15.0 immediately to close the SSRF bypass. Beyond patching, security experts recommend implementing strict authentication for all tracking servers and avoiding the use of default configurations in production environments. Administrators should also review their cloud metadata service access policies to limit the potential impact of SSRF attacks. While the primary patch is available, security teams are advised to monitor for unauthorized internal requests originating from their AI infrastructure.