Malicious actors have been observed exploiting a recently disclosed vulnerability in a popular open-source AI engineering tool, MLflow.
According to the platform’s website, “thousands of organisations” use the tool, including companies such as Meta, Accenture, and Microsoft, to build AI models, agents, and LLM applications.
CVE-2026-64849 was disclosed on 2 August and officially assigned a CVE weeks later, on 17 August.
Within hours, however, it was already being targeted.
The vulnerability is a critical unauthenticated Server-Side Request Forgery bug and is present in all versions of the platform before version 3.15.0.
“Prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body,” the CVE’s listing said.
“This issue is fixed in version 3.15.0.”
Yordan Ganchev, principal threat intelligence specialist at cyber security firm watchTowr, explained how the vulnerability works – and why it needs to be addressed urgently.
“It allows an attacker to exploit a flaw in MLflow’s model-registry webhooks to proxy requests through the affected system and interact with internal services. The security bug bypasses prior fixes because of how it handles web redirects,” Ganchev told Cyber Daily.
“Evidence from our global honeypot telemetry indicates attackers are abusing this vulnerability to target cloud-hosted MLflow systems in an attempt to extract credentials and secrets from well-known internal IP addresses and services.”
Robbie Mueller, solutions engineer at security governance firm ArmorCode, also weighed in on the severity of the vulnerability after the Cybersecurity and Infrastructure Security Agency (CISA) warned US federal agencies to address the issue.
“I would be cautious about estimating exposure based just on the download numbers, but MLflow is widely used across AI and ML environments, and these systems can exist across dev, research, engineering, and production environments,” Mueller said.
“Knowing how many organisations are affected can be challenging if they don’t have these systems represented accurately in their asset inventories and aren’t surfacing which of these are internet accessible.”
According to Mueller, if an attacker can gain credentials to an overly privileged cloud identity, that exploitation could turn into a much larger incident.
“One possible worst-case scenario is an MLflow instance gets exploited, and the attacker uses that to retrieve cloud credentials/secrets, and starts enumerating the cloud environment to access additional resources,” Mueller said.
“Depending on the permissions attached to that identity, that could lead to the compromise of sensitive data, secrets, storage, additional workloads and cloud management APIs, etc. From there, attackers could attempt data exfiltration, additional lateral movement, and cause harm in a broader environment.
“In cases like this, organisations need a universal exposure management program so that, if they can’t patch right away, they can enable compensating controls and ensure least privilege principles.”
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
