Back Ciberseguridadlatam

Falla crítica en MLflow bajo explotación activa

Ciberseguridadlatam •Redacción CSL • August 21, 2026

Una vulnerabilidad SSRF sin autenticación en la plataforma de ML más descargada del mundo permite acceso directo a servicios de metadatos en AWS, Azure y GCP. La Agencia de Ciberseguridad e Infraestructura de Estados Unidos incorporó el 17 de agosto de 2026 la vulnerabilidad CVE-2026-64849 a su catálogo de amenazas explotadas activamente. La falla afecta […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical SSRF Vulnerability in MLflow Actively Exploited, CISA Issues Warning A critical SSRF vulnerability (CVE-2026-64849) in MLflow, the world's most downloaded ML platform, allows unauthorized access to metadata services on AWS, Azure, and GCP. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its catalog of actively exploited threats on August 19, 2026. The flaw, which lacks authentication, poses a significant risk to cloud environments. As of August 21, 2026, the vulnerability is under active exploitation, with confirmed incidents of credential theft reported. Organizations using MLflow are advised to take immediate action to mitigate this risk. 2 sources 70

Extracted Entities

Falla crítica en MLflow bajo explotación activa

The full story

Extracted Entities

Companies (3)

Countries (1)

CVEs (1)

CWE Weaknesses (1)

Platforms (1)