Executive Summary
CISA added CVE-2026-64849, a critical DNS-rebinding server-side request forgery vulnerability in MLflow's webhook delivery system, to its Known Exploited Vulnerabilities catalog after confirming active exploitation. The flaw allows unauthenticated attackers to remotely access internal services and cloud metadata configurations on unpatched MLflow instances, enabling theft of AWS IAM credentials and other sensitive data. MLflow, an open-source AI engineering platform with over 30 million monthly downloads, patched the vulnerability in version 3.15.0, but federal agencies have only two weeks to secure their systems under BOD 26-04.
This incident highlights the growing attack surface created by AI infrastructure components as organizations rapidly adopt machine learning platforms without adequate security hardening, making AI systems prime targets for credential theft and lateral movement.
Why This Matters Now
AI infrastructure vulnerabilities are becoming critical attack vectors as organizations rapidly deploy ML platforms without proper security controls, creating new pathways for cloud credential theft and internal network compromise.
Attack Path Analysis
Attackers exploited CVE-2026-64849, a critical SSRF vulnerability in unauthenticated MLflow instances to access cloud metadata services and steal IAM credentials. Using the compromised credentials, attackers escalated privileges within the cloud environment and moved laterally across cloud services. They established persistent command and control channels through cloud APIs and exfiltrated sensitive data including cloud credentials and secrets before potentially deploying ransomware or causing business disruption.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attackers scanned for and exploited CVE-2026-64849 SSRF vulnerability in exposed MLflow tracking servers to access AWS IMDS and steal IAM credentials
Related CVEs
CVE-2026-64849
CVSS 9.3A critical DNS-rebinding server-side request forgery (SSRF) bypass vulnerability in MLflow's outbound webhook delivery allows unauthenticated attackers to remotely access internal services and cloud metadata configurations.
Affected Products:
MLflow Project MLflow – < 3.15.0
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Remote System Discovery
Unsecured Credentials: Cloud Instance Metadata API
Container and Resource Discovery
Remote Services: Remote Desktop Protocol
Data from Cloud Storage
Exfiltration Over C2 Channel
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Software Engineering Techniques for Bespoke and Custom Software
Control ID: Requirement 6.2.4
NYDFS 23 NYCRR 500 – Risk Assessment
Control ID: Section 500.09
DORA – Identification
Control ID: Article 8
CISA Zero Trust Maturity Model 2.0 – Application Security Controls
Control ID: Application Security - Advanced
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21.2(a)
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
Critical MLflow SSRF vulnerability enables unauthenticated attackers to steal cloud credentials and access internal services, compromising AI/ML infrastructure security.
Health Care / Life Sciences
MLflow exploitation threatens HIPAA compliance through unauthorized access to cloud metadata and patient data systems via server-side request forgery attacks.
Financial Services
SSRF attacks against MLflow platforms can expose AWS IAM credentials and internal banking systems, violating PCI compliance and enabling credential theft.
Government Administration
CISA's mandatory patching directive highlights critical risk to federal agencies using MLflow for AI applications, enabling internal network reconnaissance and data exfiltration.
Sources
- CISA warns of hackers exploiting critical MLflow vulnerabilityhttps://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-critical-mlflow-vulnerability/Verified
- CISA Adds One Known Exploited Vulnerability to Cataloghttps://www.cisa.gov/news-events/alerts/2026/08/19/cisa-adds-one-known-exploited-vulnerability-catalogVerified
- MLflow Security Advisory GHSA-7gwp-5pfp-969jhttps://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969jVerified
- watchTowr Intelligence Report on MLflow Exploitationhttps://www.linkedin.com/posts/watchtowr_watchtowr-intel-is-observing-in-the-wild-activity-7495481580723838976-qzUA/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would have constrained this MLflow SSRF attack by limiting lateral movement paths and reducing the blast radius of compromised IAM credentials through workload segmentation and controlled egress policies.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: MLflow instances would likely have been isolated from cloud metadata services through network segmentation, potentially constraining SSRF exploitation paths to IMDS endpoints and reducing credential exposure scope.
Control: Zero Trust Segmentation
Mitigation: Identity-aware access controls would likely have limited the scope of privilege escalation by constraining which roles and resources the compromised credentials could access across workload boundaries.
Control: East-West Traffic Security
Mitigation: Cross-service and inter-region movement would likely have been constrained through east-west traffic inspection and segmentation policies, reducing the attackers' ability to pivot freely across cloud resources.
Control: Multicloud Visibility & Control
Mitigation: Anomalous API usage patterns and unauthorized cloud management activities would likely have been detected and constrained through centralized visibility and behavioral analysis across the multicloud environment.
Control: Egress Security & Policy Enforcement
Mitigation: Outbound data transfers would likely have been restricted through egress filtering policies, potentially constraining the volume and destinations of exfiltrated cloud credentials and sensitive information.
Ransomware deployment scope would likely have been limited to compromised workload segments rather than spreading enterprise-wide, reducing overall business impact and recovery complexity through contained blast radius.
Impact at a Glance
Affected Business Functions
- Machine Learning Operations
- AI Model Development
- Cloud Infrastructure Management
- Data Science Pipelines
Estimated downtime: 3 days
Estimated loss: N/A
Cloud credentials including AWS IAM credentials, internal service configurations, and cloud metadata endpoints accessible through SSRF exploitation of MLflow tracking servers
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation with identity-based policies to prevent lateral movement after credential compromise
- • Deploy Egress Security & Policy Enforcement to detect and block unauthorized data exfiltration attempts
- • Enable Multicloud Visibility & Control to monitor for anomalous API activity and repeated malformed requests
- • Configure East-West Traffic Security to inspect workload-to-workload communications and detect suspicious internal flows
- • Activate Threat Detection & Anomaly Response capabilities to baseline normal behavior and alert on credential abuse patterns
