{"id":"mlflow-ssrf-cloud-credential-attacks-aug-2026","category":"patch","status":"closed","title":"MLflow SSRF flaw CVE-2026-64849 exploited to steal cloud credentials; fixes released","tldr":"Attackers used MLflow servers to reach private network services and steal cloud credentials. The original flaw is fixed in 3.15.0; use 3.16.0 or later to include follow-up protections. Ask your organisation's AI team to update and investigate exposure.","summary":"CVE-2026-64849 lets attackers who can reach a vulnerable MLflow Tracking Server make it contact private network or cloud services and return their responses, without signing in on default deployments. CISA confirmed exploitation on 19 August; watchTowr reported cloud credential and secret theft. The original flaw is fixed in MLflow 3.15.0. MLflow subsequently documented additional IPv6-related bypasses fixed in 3.16.0, which it recommends for IPv6/NAT64 networks. Sources disagree on scope and severity: the October CVE record lists versions 3.3.0 to before 3.15.0 and a critical 9.3 score; the project's advisory lists 3.10.0 to before 3.15.0 and high severity, 8.6. Red Hat supplied an OpenShift AI update in August, and Oracle lists a patch in its September security update. As of 3 November, the reviewed sources do not establish how many organisations were compromised or whether attacks have stopped.","action":"If your business runs MLflow, ask its AI or IT team to upgrade to 3.16.0 or later, restrict server access and review logs and cloud credentials for compromise. For MLflow bundled into another product, install that vendor's security update and confirm whether it includes the later IPv6 protections. Families who do not operate these systems have no direct update to install.","product":"MLflow Tracking Server","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-64849"],"tags":["mlflow","ai","ssrf","cloud","credential-theft","actively-exploited"],"affected":["MLflow >= 3.3.0, < 3.15.0 — October CVE record; the project advisory instead lists >= 3.10.0, < 3.15.0","Red Hat OpenShift AI: odh-mlflow-rhel9 server image; default deployments require Kubernetes authentication","Oracle Communications Unified Assurance 6.1.1–7.0.0, Core (MLflow)"],"fixed":["MLflow 3.15.0 — original CVE","MLflow 3.16.0 — additional IPv6-related bypass protections","Red Hat OpenShift AI 3.4.4 — RHSA-2026:60520","Oracle Communications Unified Assurance — September 2026 Critical Security Patch Update"],"matches":[],"sources":[{"kind":"advisory","title":"MLflow security advisory GHSA-7gwp-5pfp-969j","url":"https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j","by":"MLflow","date":"2026-08-02"},{"kind":"advisory","title":"MLflow 3.15.0 release","url":"https://github.com/mlflow/mlflow/releases/tag/v3.15.0","by":"MLflow","date":"2026-07-31"},{"kind":"advisory","title":"MLflow security advisory AV26-832","url":"https://www.cyber.gc.ca/en/alerts-advisories/mlflow-security-advisory-av26-832","by":"Canadian Centre for Cyber Security","date":"2026-08-19"},{"kind":"news","title":"CISA warns of hackers exploiting critical MLflow vulnerability","url":"https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-critical-mlflow-vulnerability/","by":"BleepingComputer","date":"2026-08-20"},{"kind":"news","title":"MLflow Vulnerability Exploited for Cloud Credential Theft","url":"https://www.securityweek.com/mlflow-vulnerability-exploited-for-cloud-credential-theft/","by":"SecurityWeek","date":"2026-08-20"},{"kind":"advisory","title":"CVE-2026-64849 CVE record","url":"https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/64xxx/CVE-2026-64849.json","by":"CVE Program / GitHub CNA","date":"2026-10-02"},{"kind":"advisory","title":"MLflow 3.16.0 release","url":"https://github.com/mlflow/mlflow/releases/tag/v3.16.0","by":"MLflow","date":"2026-09-04"},{"kind":"advisory","title":"RHOAI 3.4.4 — RHSA-2026:60520","url":"https://access.redhat.com/errata/RHSA-2026:60520","by":"Red Hat","date":"2026-08-27"},{"kind":"advisory","title":"CVE-2026-64849: OpenShift AI exposure and mitigation","url":"https://access.redhat.com/security/cve/cve-2026-64849","by":"Red Hat","date":""},{"kind":"advisory","title":"September 2026 Critical Security Patch Update risk matrices","url":"https://www.oracle.com/security-alerts/cspusep2026verbose.html","by":"Oracle","date":""}],"started":"2026-08-19","closed":"2026-10-02","created":"2026-11-03T22:16:39.936Z","updated":"2026-11-03T22:16:39.936Z","cve_notes":[{"cve":"CVE-2026-64849","name":"Server-side request forgery in MLflow webhooks","what":"MLflow's webhook delivery checks can be bypassed, allowing an attacker who can reach a default Tracking Server to request private network or cloud services and read their responses without signing in.","severity":"high","cvss":8.6}],"timeline":[{"at":"2026-10-02","added":"2026-11-03T22:11:23.504Z","kind":"vendor-revised","text":"The updated CVE record lists MLflow 3.3.0 to before 3.15.0 as affected and retains 3.15.0 as the fix. This differs from the project's advisory, whose affected range starts at 3.10.0.","url":"https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/64xxx/CVE-2026-64849.json","by":"CVE Program / GitHub CNA","patch":null},{"at":"2026-09-04","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"MLflow released 3.16.0. Its security advisory identifies this release as closing four additional IPv6-related ways around the original protection and recommends it for IPv6/NAT64 deployments.","url":"https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j","by":"MLflow","patch":null},{"at":"2026-08-27","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Red Hat released OpenShift AI 3.4.4 images under RHSA-2026:60520, which includes a correction for this CVE.","url":"https://access.redhat.com/errata/RHSA-2026:60520","by":"Red Hat","patch":null},{"at":"2026-08-20","added":"2026-11-03T22:11:23.504Z","kind":"wider-attacks","text":"BleepingComputer reported watchTowr's warning that attackers were using the flaw to steal cloud credentials and secrets. CISA had not published details of the attacks.","url":"https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-critical-mlflow-vulnerability/","by":"BleepingComputer","patch":null},{"at":"2026-08-19","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2026-64849 to its Known Exploited Vulnerabilities catalogue, confirming use in attacks.","url":"https://www.cyber.gc.ca/en/alerts-advisories/mlflow-security-advisory-av26-832","by":"Canadian Centre for Cyber Security","patch":null},{"at":"2026-07-31","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"MLflow released 3.15.0, the version identified as fixing CVE-2026-64849. Updates for products bundling MLflow followed later.","url":"https://github.com/mlflow/mlflow/releases/tag/v3.15.0","by":"MLflow","patch":"partial"},{"at":"2026-06-26","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"An independent researcher publicly reported the webhook flaw. MLflow's advisory says another researcher had privately reported it on 12 June.","url":"https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j","by":"MLflow","patch":"none"}],"url":"https://hard.fyi/live/mlflow-ssrf-cloud-credential-attacks-aug-2026/","json":"https://hard.fyi/api/live?id=mlflow-ssrf-cloud-credential-attacks-aug-2026"}