Overview

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding the exploitation of a critical vulnerability in the MLflow open-source AI engineering platform. This vulnerability, tracked as CVE-2026-64849, poses significant risks to organizations utilizing MLflow for managing machine learning workflows. Given its widespread adoption—over 30 million downloads monthly—this vulnerability could potentially affect numerous enterprises.

Technical Analysis

CVE-2026-64849 is classified as a DNS-rebinding server-side request forgery (SSRF) vulnerability. It specifically affects the MLflow Tracking Server, which, when configured with default settings, exposes its webhooks API without authentication. This includes a critical endpoint, /api/2.0/mlflow/webhooks/{id}/test, that allows unauthenticated users to trigger HTTP requests to internal services or cloud metadata configurations.

Attackers can exploit this vulnerability to access sensitive data, including cloud instance metadata such as AWS Identity and Access Management (IAM) credentials. The exploitation process is relatively straightforward, requiring no special privileges, making it a low-complexity attack.

Affected Systems

  • MLflow Tracking Server (default configurations)
  • Any instance running MLflow versions prior to 3.15.0
  • Systems utilizing default SQLite backend without authentication

Attack Method / Threat Activity

The exploitation of CVE-2026-64849 allows attackers to issue requests to arbitrary internal endpoints, including cloud metadata services. Once they gain access, they can exfiltrate sensitive information, such as IAM credentials, enabling further attacks on the organization’s cloud infrastructure. Reports indicate that attackers began scanning for vulnerable MLflow instances shortly after the CVE ID was assigned, highlighting the urgency of addressing this vulnerability.

Detection Opportunities

📬 Stay ahead of the threat

Get the latest SOC guides, threat intel, and detection engineering — straight to your inbox.

Organizations should implement proactive monitoring to detect unauthorized access attempts to the MLflow Tracking Server. Key detection strategies include:

  • Monitoring access logs for unusual patterns, particularly unauthorized requests to the /api/2.0/mlflow/webhooks/{id}/test endpoint.
  • Implementing intrusion detection systems (IDS) that can flag suspicious outbound requests to internal or cloud metadata services.
  • Utilizing Security Information and Event Management (SIEM) solutions to correlate logs and identify potential exploitation attempts.

Mitigation Recommendations

To protect against CVE-2026-64849, organizations should take the following actions:

  • Update MLflow: Immediately upgrade to MLflow version 3.15.0 or later, where the vulnerability has been patched.
  • Implement Authentication: Configure authentication mechanisms for the MLflow Tracking Server to restrict access to authorized users only.
  • Review Configuration: Evaluate the configuration of the MLflow server to ensure it is not exposing sensitive endpoints.
  • Audit Logs: Regularly review audit logs for signs of unauthorized access or data exfiltration.

Business Impact

The exploitation of this vulnerability can lead to severe business consequences, including unauthorized access to sensitive cloud resources, potential data breaches, and financial losses. Organizations may face regulatory scrutiny and reputational damage if sensitive data is compromised. Therefore, timely patching and configuration management are critical to safeguarding business operations.

Final Summary

The critical vulnerability in MLflow, tracked as CVE-2026-64849, presents a significant risk to organizations leveraging this platform for AI engineering. With attackers actively exploiting this flaw, it is imperative for organizations to prioritize patching, implement robust authentication measures, and continuously monitor for signs of compromise. By taking these proactive steps, organizations can mitigate the risks associated with this vulnerability and protect their sensitive data and cloud resources.