The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned of active exploitation of a critical vulnerability in MLflow, an open-source platform used to engineer artificial intelligence applications, and added it to its catalog of vulnerabilities exploited in real-world attacks. The agency ordered U.S. federal civilian executive agencies to secure affected MLflow instances within two weeks, while urging all network defenders to prioritize the patch.
The vulnerability, tracked as CVE-2026-64849, exists in MLflow’s outgoing webhook delivery mechanism. Exploitation relies on a server-side request forgery (SSRF) bypass using DNS rebinding, allowing an unauthorized attacker to force an MLflow server to send HTTP requests to internal destinations that cannot be accessed directly from the internet.
What Can the Attacker Access?
According to the MLflow security team, the tracking server’s default configuration, when run without authentication and using the default SQLite database, exposes the model registry webhook API without protection. This includes the POST /api/2.0/mlflow/webhooks/{id}/test endpoint, which returns the response status and content from the service contacted by the server to the caller.
In this way, an attacker who can access the tracking server can send requests to internal or local addresses and then read the results through the aforementioned endpoint. Potential targets include management services hidden behind network boundaries, internal ports and hosts, as well as metadata endpoints belonging to cloud service providers. In cases such as the AWS IMDS service, this could expose cloud IAM credentials.
Patch and Government Requirements
MLflow fixed the issue in version 3.15.0. The security agency describes the exploitation as low complexity and says it could enable the theft of cloud credentials, such as AWS IAM credentials, without requiring prior privileges.
CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on Wednesday and required U.S. federal civilian executive branch agencies to meet a two-week deadline under Binding Operational Directive BOD 26-04. The directive prioritizes remediation when vulnerable assets are exposed to the internet, when the vulnerability is listed in the CISA catalog, when its exploitation can be automated at scale, or when exploitation gives the attacker partial or complete control over the targeted system.
Why Does This Warning Matter?
MLflow is used by thousands of organizations and receives more than 30 million downloads per month. The platform also supports debugging, evaluating, optimizing, and monitoring artificial intelligence applications. Therefore, the vulnerability’s impact is not limited to a single server; an accessible and unprotected tracking server could turn a component intended to manage artificial intelligence applications into a gateway to internal services or cloud credentials.
BOD 26-04 applies only to U.S. government agencies, but CISA urged all network defenders to assess the internet exposure of MLflow instances and update them to version 3.15.0 or a later available release. The warning emphasizes that assessing each asset and applying remediation guidance remains the responsibility of the operating organization.