Threat · curated 8 Aug 2026
CISA Adds One Known Exploited Vulnerability to Catalog
First reported · updated · 3 reports cisa.gov
Coverage timeline
Why it matters
CVE-2026-64849 exposes AI/ML infrastructure used by thousands of organizations to unauthenticated SSRF and cloud-credential theft, and its confirmed in-the-wild exploitation makes patching MLflow tracking servers urgent for defenders running LLM and agent pipelines.
CISA warned that threat actors are actively exploiting CVE-2026-64849, a critical DNS-rebinding SSRF bypass in MLflow's outbound webhook delivery, and added it to its Known Exploited Vulnerabilities catalog. MLflow is a widely used open-source AI engineering platform for LLMs and agents; the flaw lets unauthenticated attackers reach the tracking server and make it issue requests to internal/loopback/cloud-metadata endpoints, enabling theft of cloud credentials such as AWS IMDS IAM credentials. The vulnerability was patched in MLflow 3.15.0.
Summary
CISA added CVE-2026-64849, a critical DNS-rebinding server-side request forgery (SSRF) bypass in MLflow's outbound webhook delivery, to its Known Exploited Vulnerabilities catalog on August 19, 2026, confirming active exploitation in the wild. The vulnerability was patched in MLflow version 3.15.0.[0][7][8]
The flaw allows an unauthenticated attacker who can reach a default MLflow Tracking Server to coerce the server into issuing HTTP requests to internal, loopback, or cloud-metadata endpoints and read the responses, enabling theft of cloud credentials such as AWS IAM credentials in low-complexity attacks. No specific threat actor has been attributed to the observed exploitation.[0][6]
CISA directed U.S. Federal Civilian Executive Branch agencies to secure their MLflow instances within two weeks under Binding Operational Directive 26-04, and urged all network defenders to prioritize patching given MLflow's wide deployment across thousands of organizations.[0]
Attack chain
- Access: An unauthenticated attacker reaches an internet-exposed default MLflow Tracking Server (mlflow server, no authentication, default SQLite backend), which exposes the model-registry webhooks API without authentication.[0][6]
- SSRF exploitation: The attacker abuses the synchronous POST /api/2.0/mlflow/webhooks/{id}/test endpoint, leveraging a DNS-rebinding bypass, to make the server issue HTTP requests to arbitrary internal, loopback, or cloud-metadata endpoints.[0][6]
- Credential and data access: The endpoint returns the upstream response status and body to the caller, allowing the attacker to read cloud instance-metadata (e.g. AWS IMDS IAM credentials), reach internal-only admin services, and perform internal port/host scanning.[0][6]
Disclosure timeline
| Date | Event |
|---|---|
| Approximately late July 2026 | MLflow's security team issued a security advisory (GHSA-7gwp-5pfp-969j) describing the vulnerability, roughly three weeks before the news report.[0][6] |
| June 2026 | CISA issued Binding Operational Directive 26-04, mandating prioritized patching of exploited flaws.[0] |
| August 19, 2026 | CISA added CVE-2026-64849 to its Known Exploited Vulnerabilities catalog and ordered FCEB agencies to remediate within two weeks.[0][7][8] |
| August 20, 2026 | BleepingComputer reported on CISA's warning of active exploitation.[0] |
How it works
The default MLflow Tracking Server (mlflow server, no authentication, default SQLite backend) exposes the model-registry webhooks API unauthenticated, including a synchronous POST /api/2.0/mlflow/webhooks/{id}/test endpoint that returns the upstream response status and body to the caller.[0][6]
The flaw is a DNS-rebinding SSRF bypass: an unauthenticated attacker who can reach the tracking server makes the server issue HTTP requests to arbitrary internal, loopback, or cloud-metadata endpoints and reads the responses via the /test endpoint, enabling access to cloud instance-metadata (e.g. AWS IMDS IAM credentials), internal-only admin services behind the network boundary, and internal port/host scanning.[0][6]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| MLflow (open-source AI engineering platform) | Versions prior to 3.15.0 running the default Tracking Server configuration with no authentication | Patched in version 3.15.0[0] |
Indicators of Compromise
| Type | Indicator | Context |
|---|---|---|
| cve | CVE-2026-64849 | Critical DNS-rebinding SSRF bypass in MLflow's webhook delivery, added to CISA's KEV catalog as exploited in the wild.[0][7][8] |
Key takeaways
- An unauthenticated SSRF bypass in a widely deployed AI/ML platform can be leveraged to steal cloud IAM credentials and reach internal services, illustrating that ML infrastructure is now a direct target for opportunistic exploitation.[0][6]
- Default, unauthenticated MLflow Tracking Server deployments exposed to the internet are the primary risk surface; segmenting and authenticating these servers materially reduces exposure.[0][6]
Defensive actions
- Upgrade MLflow to version 3.15.0 or later.: Version 3.15.0 patches the SSRF bypass; unpatched default instances are exploitable by unauthenticated attackers.[0]
- FCEB agencies must secure MLflow instances within two weeks per BOD 26-04; all defenders should prioritize patching internet-exposed instances.: CISA mandated remediation and urged prioritized patching because this SSRF flaw is actively exploited and MLflow servers may be publicly exposed.[0]
- Evaluate each MLflow asset's internet exposure and restrict access to the Tracking Server, avoiding unauthenticated default configurations reachable from untrusted networks.: The default no-authentication Tracking Server exposes the webhooks API to any attacker who can reach it, enabling access to cloud metadata and internal services.[0][6]