Critical MLflow SSRF Vulnerability Exploited by Hackers in the Wild

Cybersecuritynews •Guru Baran • August 18, 2026

Threat actors are actively exploiting a critical, unauthenticated server-side request forgery (SSRF) vulnerability in MLflow, the popular open-source platform widely used by data engineering and machine learning teams to track experiments, package code, and deploy models. Tracked as CVE-2026-64849 with a critical CVSS 3.1 score of 9.3, the flaw impacts all MLflow versions prior to […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Active Exploitation of MLflow SSRF Vulnerability CVE-2026-64849 A critical unauthenticated server-side request forgery (SSRF) vulnerability in MLflow, tracked as CVE-2026-64849, is being actively exploited within hours of its disclosure on August 17, 2026. This flaw affects MLflow versions prior to 3.15.0 and can expose sensitive data, including cloud credentials and internal services, to remote attackers. The vulnerability was confirmed by watchTowr, indicating a significant risk for organizations using affected versions. Attackers can leverage this flaw to gain unauthorized access to sensitive information, raising concerns about data breaches. Security teams are urged to assess their systems and apply necessary patches immediately to mitigate risks. 7 sources 73

Extracted Entities

Critical MLflow SSRF Vulnerability Exploited by Hackers in the Wild

The full story

Extracted Entities

Companies (1)

CVEs (1)

CWE Weaknesses (1)