Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets

Back Thehackernews

Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets

Thehackernews • August 18, 2026

Share: View original

AI can find and chain vulnerabilities in minutes. This session gives you a practical roadmap to strengthen visibility, response, and remediation.

AI is helping teams ship code 10–50× faster. This session shows how to keep security from falling behind.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Active Exploitation of MLflow SSRF Vulnerability CVE-2026-64849 A critical unauthenticated server-side request forgery (SSRF) vulnerability in MLflow, tracked as CVE-2026-64849, is being actively exploited within hours of its disclosure on August 17, 2026. This flaw affects MLflow versions prior to 3.15.0 and can expose sensitive data, including cloud credentials and internal services, to remote attackers. The vulnerability was confirmed by watchTowr, indicating a significant risk for organizations using affected versions. Attackers can leverage this flaw to gain unauthorized access to sensitive information, raising concerns about data breaches. Security teams are urged to assess their systems and apply necessary patches immediately to mitigate risks. 7 sources 73

Extracted Entities

Attack Types (1)

Companies (1)

CWE Weaknesses (2)

CWE-200 - Exposure of Sensitive Information CWE-918 - Server-Side Request Forgery (ssrf)