The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning to federal agencies regarding active exploitation of a critical vulnerability in MLflow, an open-source AI engineering platform. The flaw, identified as CVE-2026-64849, is a DNS-rebinding server-side request forgery (SSRF) bypass that affects MLflow's outbound webhook delivery.
MLflow, which is backed by the Linux Foundation and boasts over 30 million monthly downloads, is widely used for developing and monitoring AI applications, including large language models (LLMs). The vulnerability was patched in version 3.15.0.
According to MLflow's security team, the default MLflow Tracking Server, when configured without authentication and using a default SQLite backend, exposes the model-registry webhooks API. This includes a synchronous POST /api/2.0/mlflow/webhooks/{id}/test endpoint that returns the upstream response status and body to the caller.
This configuration allows an unauthenticated attacker who can reach the tracking server to force the server to issue HTTP requests to arbitrary internal, loopback, or cloud-metadata endpoints. The attacker can then read the responses via the /test endpoint. This capability can be leveraged to access cloud instance metadata, such as AWS IMDS IAM credentials, internal-only administrative services, or to perform internal port and host scanning.
Successful exploitation of CVE-2026-64849 can lead to the theft of cloud credentials, including AWS Identity and Access Management (IAM) credentials, through low-complexity attacks.
CISA added the vulnerability to its catalog of actively exploited flaws on Wednesday, August 20, 2026. In response, U.S. Federal Civilian Executive Branch (FCEB) agencies have been mandated to secure their MLflow instances within two weeks, in accordance with Binding Operational Directive 26-04. This directive, issued in June, requires prioritized patching for publicly exposed assets, vulnerabilities listed in CISA's KEV catalog, flaws that allow for automated large-scale exploitation, and those granting partial or total system control.
While CISA has not yet released specific details about the ongoing attacks, a cybersecurity firm reported that attackers began scanning for MLflow systems within hours of the CVE ID being assigned. The firm indicated that attackers are exploiting the vulnerability to directly access cloud metadata services and exfiltrate cloud credentials and secrets. Organizations running MLflow are advised to prioritize patching exposed systems, review audit logs for signs of compromise, and verify whether sensitive credentials may have been exposed.
This warning follows a separate alert from CISA on Tuesday regarding active exploitation of a critical remote code execution (RCE) flaw in the Windows Internet Key Exchange (IKE) Service Extensions component.
