MLflow SSRF flaw lets attackers steal cloud credentials now

If your team runs MLflow on a cloud instance with a permissive IAM role, someone may already have your temporary credentials. Attackers started scanning for exposed MLflow tracking servers within hours of CVE-2026-64849 being assigned on August 17, 2026, and they are using the flaw to pull cloud credentials straight from instance metadata endpoints. This is not a theoretical risk: security researchers have already confirmed compromises on over a hundred servers.

MLflow SSRF vulnerability CVE-2026-64849 exposes cloud credentials on 238 servers. Attackers stole secrets from 103 within hours of disclosure.

The vulnerability, tracked as CVE-2026-64849 with a CVSS score of 9.3, affects MLflow versions earlier than 3.15.0. It is an unauthenticated server-side request forgery flaw in MLflow's model-registry webhook handling that lets anyone who can reach your tracking server issue HTTP requests to internal services, including cloud metadata endpoints at 169.254.169.254. Those endpoints return the temporary credentials your cloud workloads use to access storage, databases, and internal APIs. An attacker who grabs those credentials can read your data, access model artifacts, or move laterally into other cloud services, depending on what permissions the role carries.

What exactly does the MLflow SSRF flaw let attackers do?

The technical mechanics are what make this dangerous. MLflow's tracking server exposes a webhook testing endpoint at POST /api/2.0/mlflow/webhooks/{id}/test that, by default, requires no authentication. When you call this endpoint, MLflow fetches the webhook URL and returns the upstream response body directly to the caller.

An earlier SSRF fix shipped in MLflow 3.10.0 added a validation function called _validate_webhook_url that resolves the webhook hostname and rejects non-public IP addresses. The problem, as detailed in the GitHub security advisory, is that the fix validates the initial hostname but then follows HTTP redirects without re-checking the redirect target.

Here is the attack chain:

1. The attacker registers a webhook pointing to their own public HTTPS server. This passes the SSRF guard because the IP is public.
2. The attacker's server responds with a 302 Location: http://169.254.169.254/latest/meta-data/iam/security-credentials/ redirect.
3. MLflow follows the redirect to the cloud metadata endpoint without re-validating the IP.
4. The /test endpoint reflects the response body back to the attacker, who now holds your cloud credentials.

The advisory confirms this was tested successfully against mlflow==3.13.0 with a default SQLite server configuration. In one proof of concept, the response body returned internal secrets including an INTERNAL_SECRET value and a role=admin string.

The 302 redirect variant gives attackers full-read access to any internal HTTP service. But the advisory also flags a blind write variant: if the attacker's server returns a 307 or 308 status code, the original POST method and body are preserved on the redirect. That means an attacker can POST controlled payloads into internal management endpoints like a Docker daemon's /stop endpoint, Elasticsearch's /_close, or Spring Boot Actuator's /shutdown. Your MLflow server becomes a proxy into your internal network.

How many servers are exposed and already compromised?

The numbers are ugly. A coordinated attack campaign documented in the MLflow GitHub issue tracker has identified at least 238 exposed MLflow servers, with 103 of those showing confirmed indicators of compromise. The compromise indicators include DNS callback payloads using the dnsg.cc domain, Interactsh SSRF probes hitting oast.* addresses, path traversal attempts against /proc/self, and a linked Ollama supply chain compromise.

The chart above shows the scale of exposure for both the MLflow and FUXA vulnerabilities tracked in this campaign. For MLflow, 238 servers are confirmed exposed and 103 show active compromise. For FUXA, roughly 60 instances are publicly reachable.

watchTowr, a security research firm, reported detecting indiscriminate scans for exposed MLflow instances within hours of the CVE assignment on August 17. Their global honeypot telemetry showed attackers specifically targeting cloud-hosted MLflow systems to extract credentials from well-known internal IP addresses and services.

Yordan Ganchev, principal threat intelligence specialist at watchTowr, said the vulnerability bypasses prior fixes because of how MLflow handles web redirects. The attackers are reaching cloud metadata services directly and exfiltrating credentials and secrets. This is live, active, and automated.

Why does this bypass previous MLflow SSRF fixes?

This is the part that should frustrate anyone who patched after the first SSRF disclosure. MLflow shipped an SSRF guard in version 3.10.0 that validated webhook URLs by resolving hostnames and rejecting anything pointing at private IP space. That fix was the right idea. It just did not cover the full attack surface.

The original validation ran once, before the HTTP request was made. It checked the resolved IP of the hostname in the webhook URL. But HTTP redirects create a second hop that the guard never inspected. An attacker could pass validation with a clean public IP, then redirect to anything internal. The validation was a checkpoint at the front door, but the side door was left open.

The fix in version 3.15.0, shipped via PR #24258, takes a different approach. Instead of validating the hostname before the request, it adds an SSRFProtectedHTTPAdapter that validates the peer IP of each connected socket immediately after the TCP connection is established, before any TLS or HTTP exchange happens. Each redirect opens a new connection through the protected pool, so redirect targets get the same validation as the initial request.

This closes both the 302 read variant and the 307/308 write variant, plus a DNS-rebinding time-of-check-to-time-of-use race condition that the earlier fix did not address. If you patched at 3.10.0 and thought you were done, you were not. Versions 3.10.0 through 3.14.x all carry the redirect bypass.

What is happening with the FUXA vulnerability?

The same wave of scanning hit a different target. VulnCheck detected scans starting August 18, 2026 targeting CVE-2026-25895, a critical vulnerability in FUXA with a CVSS score of 9.5. FUXA is an open-source, web-based SCADA and HMI platform used in operational technology and industrial automation environments.

The flaw combines missing authentication for a critical function with a path traversal vulnerability. An unauthenticated, remote attacker can write arbitrary files to the FUXA server's filesystem, which could lead to remote code execution under the server's privileges. It affects FUXA versions 1.2.9 and earlier.

VulnCheck counted about 60 publicly reachable FUXA instances. A single IP address was observed broadly scanning the internet for vulnerable installations. Caitlin Condon, VulnCheck's vice president of research, said the attacker request attempts to overwrite main.js with junk data via the path traversal. No RCE payloads have been dropped yet, but the overwrite of a core application file suggests the attacker is testing whether the vulnerability works before returning with a real payload.

VulnCheck also linked recent exploitation to two other FUXA vulnerabilities: CVE-2026-25939 and CVE-2023-33831. Activity involving the older CVE-2023-33831 dates back to November 2025 and continued through August 17, 2026. If you run FUXA and have not patched in the last year, assume it has been probed.

What should you do right now if you run MLflow or FUXA?

For MLflow, the priorities are clear and sequential:

• Upgrade to version 3.15.0 or later immediately. This is the only version that includes the SSRFProtectedHTTPAdapter fix. Anything below 3.15.0, including 3.10.0 through 3.14.x, is vulnerable to the redirect bypass.
• Take exposed tracking servers off the public internet. If your MLflow server has a public IP, move it behind a VPN, a private subnet, or an authenticated reverse proxy. The default mlflow server ships with no authentication. That was always a problem. Now it is an active exploit path.
• Rotate cloud credentials for any server that was exposed. If attackers hit your metadata endpoint, they have your IAM role's temporary credentials. Rotate the role, revoke active sessions, and review CloudTrail or equivalent logs for API calls that do not match your normal usage patterns.
• Check audit logs for webhook creation and test calls. Look for POST /api/2.0/mlflow/webhooks and POST /api/2.0/mlflow/webhooks/*/test calls from untrusted sources. Any webhook URL pointing at an unknown external domain is a candidate for the redirect attack.

For FUXA, the steps are similar but the stakes are different because FUXA sits in operational technology environments:

• Upgrade to a fixed release. Remove direct internet access from any FUXA installation. Sixty exposed instances is a small number, but each one is a potential bridge from a web request to industrial control systems.
• Inspect web-server and application logs for path traversal strings and unexpected file modifications, particularly any changes to main.js.
• Place FUXA behind authentication and network controls if you have not already. An unauthenticated SCADA interface on the public internet is an incident waiting to happen.

If you are building AI infrastructure, this is a pattern worth internalizing. The same MLflow tracking server that your data scientists love for its frictionless setup is the one that attackers love for the same reason. The default configuration is built for demos, not production. Every component in your AI pipeline that accepts unauthenticated input and makes outbound HTTP requests is a candidate for SSRF. The ChainDrop npm worm showed how AI build tools leak cloud secrets through poisoned packages. This MLflow flaw shows how AI serving tools do the same thing from a different angle.

Your AI stack's defaults are the attack surface

The MLflow SSRF flaw is a predictable result of running a tool designed for local experimentation directly on the internet with cloud credentials attached. The fix was incomplete once already. The scanning started within hours of the CVE being assigned. The compromise rate is north of 40 percent on exposed servers. If you operate AI infrastructure in the cloud, treat every unauthenticated endpoint as a potential credential exfiltration path, and treat every SSRF patch as incomplete until you have verified it covers HTTP redirects.

Sources

• The Hacker News: Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets
• GitHub Security Advisory GHSA-7gwp-5pfp-969j: Unauthenticated full-read SSRF in MLflow webhook delivery
• GitHub Issue #23500: Mass SSRF via unauthenticated model registration API
• InfoSec Today: Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets
• OSV: CVE-2026-2393, MLflow webhook SSRF