Critical MLflow SSRF Flaw Exploited in the Wild

Gbhackers •Divya • August 18, 2026

A critical unauthenticated server-side request forgery (SSRF) vulnerability in MLflow, tracked as CVE-2026-64849, is being actively exploited within hours of its disclosure, according to watchTowr. This flaw affects MLflow versions before 3.15.0 and can expose cloud credentials, internal services, and other sensitive data to remote attackers. MLflow SSRF Flaw The vulnerability exists in MLflow’s model-registry […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Active Exploitation of MLflow SSRF Vulnerability CVE-2026-64849 A critical unauthenticated server-side request forgery (SSRF) vulnerability in MLflow, tracked as CVE-2026-64849, is being actively exploited within hours of its disclosure on August 17, 2026. This flaw affects MLflow versions prior to 3.15.0 and can expose sensitive data, including cloud credentials and internal services, to remote attackers. The vulnerability was confirmed by watchTowr, indicating a significant risk for organizations using affected versions. Attackers can leverage this flaw to gain unauthorized access to sensitive information, raising concerns about data breaches. Security teams are urged to assess their systems and apply necessary patches immediately to mitigate risks. 7 sources 73

Extracted Entities

Critical MLflow SSRF Flaw Exploited in the Wild

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (2)

Vulnerabilities (1)