CVE-2026-64849: MLflow Webhook SSRF Exploited in the Wild — AI Infrastructure Leaks Cloud IAM Credentials

Unauthenticated SSRF CVE-2026-64849 in the MLflow experiment platform, CVSS 9.3. watchTowr saw mass scanning hours after disclosure. Attackers follow webhook redirects to 169.254.169.254 and steal IAM credentials. Same window: FUXA SCADA/HMI CVE-2026-25895 path traversal, CVSS 9.5, scanned on the public internet.

MLflow CVE-2026-64849 unauthenticated SSRF was assigned 17 Aug 2026. watchTowr global honeypots observed mass scanning within hours. Attackers pivot through internet-exposed Tracking Servers, abuse webhook 3xx-follow, hit 169.254.169.254 metadata, and steal instance IAM temporary credentials on AWS / GCP / Azure. Same disclosure window: open-source SCADA/HMI FUXA CVE-2026-25895 path-traversal RCE. VulnCheck on 18 Aug captured a single IP scanning ~60 public FUXA instances.

Incident Overview

MLflow is widely used for ML experiment tracking, model registry, and deployment. Defect sits in model-registry webhook handling: Tracking Server validates only the initial webhook URL at registration; subsequent requests that follow external 3xx redirects to internal addresses skip a second whitelist check. watchTowr principal threat intelligence Yordan Ganchev: attacker registers a webhook pointing at their own server; that server returns 302 to an internal service; MLflow follows and reaches arbitrary internal endpoints, including cloud IMDS.

On AWS EC2, IMDSv1 allows an anonymous GET to `169.254.169.254/latest/meta-data/iam/security-credentials/<role>` and returns role temporary credentials. If the MLflow host has S3 data-lake R/W, ECR push, or Secrets Manager, SSRF becomes full cloud-account compromise. Concurrent FUXA CVE-2026-25895 path traversal affects 1.2.9 and below: unauthenticated remote write of .js / .php into the web root for RCE. ~60 public OT operations consoles face production-stop risk.

Technical Details

• CVSS: CVE-2026-64849 is 9.3 (unauthenticated SSRF + internal reach, high impact); CVE-2026-25895 is 9.5 (unauthenticated path-traversal write + RCE).
• Trigger surface: MLflow Tracking Server listens by default with no built-in auth. Data teams often hang it on a public load balancer or a loose security group. Instances matching that profile are the target.
• Bypass: CVE-2026-64849 bypasses earlier MLflow webhook-redirect hardening. First hop is checked; the final target after following the redirect is not.
• Scanning: watchTowr hive logs show mass fingerprinting and credential-pull requests on 17 Aug, the day the CVE ID went public. VulnCheck observed FUXA attackers attempting to overwrite main.js; no complete RCE payload delivered.

Impact Assessment

Most MLflow hosts run analytics and training workloads and carry relatively loose IAM roles. A single SSRF can obtain temporary credentials covering the entire data lake, model repository, and training pipeline. FUXA is common for plant-floor visualization and device consoles. Unauthenticated RCE plus in-the-wild CVE-2026-25939 and CVE-2023-33831 since August forms a chained OT operations threat. watchTowr and VulnCheck state no Skillchain RCE payload has been observed yet; credential theft and JS overwrite evidence is enough to trigger emergency patching.

Remediation

• Upgrade MLflow to 3.15.0 or later. Re-validate the whitelist against the final target after webhook redirect follow.
• Immediately force IMDSv2 on all MLflow nodes (`http_tokens=required`) and set hop-limit to 1. Blocks anonymous SSRF credential pulls at the source.
• Review MLflow audit logs for unusual webhook calls to 169.254.169.254, 10.0.0.0/8, 172.16.0.0/12, and other private IPs. Rotate every AWS IAM Access Key, Azure Managed Identity Token, and GCP Service Account Key the MLflow process could reach in that window.
• Move the MLflow Tracking Server off the public load balancer behind intranet or VPN. Add mTLS and OAuth. Disable the default unauthenticated listener.
• FUXA users: upgrade to 1.2.10 or later. Cut public access if needed. Audit main.js, config files, and recently modified PHP entry points.

References

• The Hacker News Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets
• Protect.computer MLflow SSRF CVE-2026-64849 Cloud Credentials
• watchTowr / Etairos Hours After Disclosure exploit analysis
• Enigma Global Daily Threat Intelligence Digest 18 Aug