Article - ThreatCluster

Back Ciberseguridadlatam

Ciberseguridadlatam •Redacción CSL • August 21, 2026

# Falla crítica en MLflow bajo explotación activa — CISA confirma robo de credenciales en la nube Una vulnerabilidad SSRF sin autenticación en la plataforma de ML más descargada del mundo permite acceso directo a servicios de metadatos en AWS, Azure y GCP. La Agencia de Ciberseguridad e Infraestructura de Estados Unidos incorporó el 17 […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical SSRF Vulnerability in MLflow Actively Exploited, CISA Issues Warning A critical SSRF vulnerability (CVE-2026-64849) in MLflow, the world's most downloaded ML platform, allows unauthorized access to metadata services on AWS, Azure, and GCP. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its catalog of actively exploited threats on August 19, 2026. The flaw, which lacks authentication, poses a significant risk to cloud environments. As of August 21, 2026, the vulnerability is under active exploitation, with confirmed incidents of credential theft reported. Organizations using MLflow are advised to take immediate action to mitigate this risk. 2 sources 70

The full story

Extracted Entities

Companies (3)

CWE Weaknesses (1)