A critical server side request forgery vulnerability in an open source machine learning operations platform has been formally added to the federal Known Exploited Vulnerabilities catalog. The defect permits unauthenticated remote actors to transmit malformed webhook requests that query internal network microservices and cloud metadata services.
The vulnerability, tracked as CVE-2026-64849, impacts MLflow instances prior to version 3.15.0. The issue resides within the outbound webhook delivery module handling DNS rebinding protection checks. An unauthenticated attacker targeting exposed tracking servers can issue HTTP requests to arbitrary internal endpoints, reading responses via diagnostic test routes. Threat actors are actively exploiting the flaw to query cloud instance metadata services, exfiltrating temporary AWS IMDS IAM access keys and internal database secrets.
Subverting machine learning infrastructure introduces severe cloud credential exposure across enterprise AI pipelines. Armed with exfiltrated cloud IAM tokens and internal API credentials, threat actors can bypass perimeter security boundaries, access proprietary cloud storage buckets, and execute lateral movement sweeps across enterprise cloud environments.
– Force immediate maintenance upgrades across all MLflow platform deployments to version 3.15.0 or higher.
– Restrict web access to MLflow tracking dashboards by placing management interfaces behind zero trust pre-authentication proxies.
– Enforce strict IMDSv2 hop limit controls across cloud compute nodes to prevent server side request forgery metadata extraction.
– Rotate all cloud IAM credentials and database access keys processed on exposed MLflow tracking hosts.
Machine learning operational security relies on rigid outbound webhook validation and strict cloud metadata access controls to ensure AI tracking servers cannot serve as automated credential theft vectors. #CodeDefence #MLflow #AISecurity #SSRF #CloudSecurity #IAM #CISA #KEV
/
