CVE-2026-64849 — a critical DNS-rebinding server-side request forgery (SSRF) bypass in MLflow — has been confirmed as exploited in the wild, and federal agencies have been ordered to patch exposed instances within two weeks.
What the flaw is and where it lives
MLflow, the open-source AI engineering platform backed by the Linux Foundation and used to debug, evaluate, optimize, and monitor AI applications, is widely distributed with "over 30 million monthly downloads" and deployment at thousands of organizations. The MLflow vulnerability tracked as CVE-2026-64849 is a DNS-rebinding SSRF bypass in MLflow's outbound webhook delivery that was patched in version 3.15.0.
In a security advisory published three weeks ago, MLflow's security team described how the default Tracking Server can expose the model-registry webhooks API without authentication. The advisory says: "The default MLflow Tracking Server (mlflow server, no authentication, default SQLite backend) exposes the model-registry webhooks API unauthenticated, including a synchronous POST /api/2.0/mlflow/webhooks/{{id}}/test endpoint that returns the upstream response status and body to the caller."
How attackers are using the flaw
Because the /test endpoint returns upstream response data, an unauthenticated attacker who can reach a vulnerable tracking server can cause that server to issue HTTP requests to arbitrary internal, loopback, or cloud-metadata endpoints and then read the responses via the /test endpoint. MLflow's advisory lists specific consequences: the server can be made to request "cloud instance-metadata (e.g. AWS IMDS IAM credentials), internal-only admin services behind the network boundary, and internal port/host scanning."
Those capabilities mean successful exploitation can allow threat actors to steal cloud credentials — "such as AWS Identity and Access Management (IAM) credentials" — and the advisory characterizes these attacks as low complexity.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleCISA's directive and the two-week deadline
The Cybersecurity and Infrastructure Security Agency has added CVE-2026-64849 to its catalog of flaws "exploited in the wild" and ordered U.S. Federal Civilian Executive Branch (FCEB) agencies to secure their MLflow instances within two weeks under Binding Operational Directive 26-04 (BOD 26-04).
BOD 26-04, issued in June, requires U.S. government agencies to prioritize patching when specific criteria are met: the vulnerable assets are publicly exposed online; the flaw has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog; the vulnerability can be exploited at scale through automation; or successful exploitation grants an attacker partial or total control of a targeted system. While BOD 26-04 applies only to U.S. government agencies, CISA explicitly urged "all network defenders to prioritize patching their systems against attacks targeting CVE-2026-64849."
On the broader risk, CISA warned: "This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise." The agency also reminded recipients that stakeholders must evaluate each asset's internet exposure and ensure adherence to BOD 26-04 patching guidelines.
Other active abuse CISA called out
Alongside the MLflow notice, CISA warned that hackers are also abusing a critical-severity remote code execution (RCE) flaw in the Windows Internet Key Exchange (IKE) Service Extensions component. That advisory was issued one day earlier, indicating multiple high-severity issues are being exploited concurrently.
What this means for MLflow users, federal agencies, and cloud operators
- MLflow users and security teams: Confirm whether tracking servers are publicly reachable and whether they run a vulnerable configuration (default tracking server with no authentication). The patched release is version 3.15.0; the MLflow advisory makes clear the unauthenticated synchronous POST /api/2.0/mlflow/webhooks/{{id}}/test endpoint is the immediate attack surface.
- Federal Civilian Executive Branch agencies and policymakers: BOD 26-04 creates a two-week remediation window for exposed MLflow instances because CISA has listed CVE-2026-64849 in its KEV catalog. Agencies must prioritize adherence to the directive's criteria and evaluate internet exposure for each asset.
- Cloud operators and DevOps teams: The advisory highlights cloud instance-metadata endpoints — "e.g. AWS IMDS IAM credentials" — as a direct prize for attackers. Teams should treat potential theft of cloud credentials as the primary impact vector when assessing risk and mitigation priorities.
With CISA's KEV designation and the BOD 26-04 deadline, the vulnerability has moved from advisory to urgent: update to MLflow 3.15.0 where possible, assess internet exposure of tracking servers, and treat cloud-metadata access as a first-order risk. The agency's notice and MLflow's advisory together make plain which endpoint is being abused and the concrete, low-complexity consequences of exploitation — stolen cloud credentials and internal reconnaissance.
Read the original reporting: https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-critical-mlflow-vulnerability/
