MLflow SSRF flaw CVE-2026-64849 exploited to steal cloud credentials; fixes released
Attackers used MLflow servers to reach private network services and steal cloud credentials. The original flaw is fixed in 3.15.0; use 3.16.0 or later to include follow-up protections. Ask your organisation's AI team to update and investigate exposure.
If your business runs MLflow, ask its AI or IT team to upgrade to 3.16.0 or later, restrict server access and review logs and cloud credentials for compromise. For MLflow bundled into another product, install that vendor's security update and confirm whether it includes the later IPv6 protections. Families who do not operate these systems have no direct update to install.
What’s happening
CVE-2026-64849 lets attackers who can reach a vulnerable MLflow Tracking Server make it contact private network or cloud services and return their responses, without signing in on default deployments. CISA confirmed exploitation on 19 August; watchTowr reported cloud credential and secret theft. The original flaw is fixed in MLflow 3.15.0. MLflow subsequently documented additional IPv6-related bypasses fixed in 3.16.0, which it recommends for IPv6/NAT64 networks. Sources disagree on scope and severity: the October CVE record lists versions 3.3.0 to before 3.15.0 and a critical 9.3 score; the project's advisory lists 3.10.0 to before 3.15.0 and high severity, 8.6. Red Hat supplied an OpenShift AI update in August, and Oracle lists a patch in its September security update. As of 3 November, the reviewed sources do not establish how many organisations were compromised or whether attacks have stopped.
- What
- Flaw
- Affects
- MLflow Tracking Server
- Affected
- MLflow >= 3.3.0, < 3.15.0 — October CVE record; the project advisory instead lists >= 3.10.0, < 3.15.0
Red Hat OpenShift AI: odh-mlflow-rhel9 server image; default deployments require Kubernetes authentication
Oracle Communications Unified Assurance 6.1.1–7.0.0, Core (MLflow) - Fixed in
- MLflow 3.15.0 — original CVE
MLflow 3.16.0 — additional IPv6-related bypass protections
Red Hat OpenShift AI 3.4.4 — RHSA-2026:60520
Oracle Communications Unified Assurance — September 2026 Critical Security Patch Update - Since
- 19 Aug 2026
- Closed
- 2 Oct 2026
Timeline
- Vendor revised
The updated CVE record lists MLflow 3.3.0 to before 3.15.0 as affected and retains 3.15.0 as the fix. This differs from the project's advisory, whose affected range starts at 3.10.0.
- New fix
MLflow released 3.16.0. Its security advisory identifies this release as closing four additional IPv6-related ways around the original protection and recommends it for IPv6/NAT64 deployments.
- New fix
Red Hat released OpenShift AI 3.4.4 images under RHSA-2026:60520, which includes a correction for this CVE.
- Wider attacks
BleepingComputer reported watchTowr's warning that attackers were using the flaw to steal cloud credentials and secrets. CISA had not published details of the attacks.
- CISA added
CISA added CVE-2026-64849 to its Known Exploited Vulnerabilities catalogue, confirming use in attacks.
- New fixPartly fixed
MLflow released 3.15.0, the version identified as fixing CVE-2026-64849. Updates for products bundling MLflow followed later.
- Made publicNo fix yet
An independent researcher publicly reported the webhook flaw. MLflow's advisory says another researcher had privately reported it on 12 June.
Sources
- MLflow security advisory GHSA-7gwp-5pfp-969jMLflow · 2 Aug 2026
- MLflow 3.15.0 releaseMLflow · 31 July 2026
- MLflow security advisory AV26-832Canadian Centre for Cyber Security · 19 Aug 2026
- CISA warns of hackers exploiting critical MLflow vulnerabilityBleepingComputer · 20 Aug 2026
- MLflow Vulnerability Exploited for Cloud Credential TheftSecurityWeek · 20 Aug 2026
- CVE-2026-64849 CVE recordCVE Program / GitHub CNA · 2 Oct 2026
- MLflow 3.16.0 releaseMLflow · 4 Sept 2026
- RHOAI 3.4.4 — RHSA-2026:60520Red Hat · 27 Aug 2026
- CVE-2026-64849: OpenShift AI exposure and mitigationRed Hat
- September 2026 Critical Security Patch Update risk matricesOracle