The **Cybersecurity and Infrastructure Security Agency (CISA)** has alerted federal agencies to ongoing exploitation of a critical vulnerability in **MLflow**, an open-source AI engineering platform. **MLflow**, backed by the **Linux Foundation**, boasts over 30 million monthly downloads and is utilized by thousands of organizations for developing and monitoring AI applications. ### Unauthenticated Access to Internal Services The vulnerability, identified as **CVE-2026-64849**, is a critical DNS-rebinding server-side request forgery (SSRF) bypass within **MLflow**'s outbound webhook delivery. It was patched in version 3.15.0. Exploitation of this flaw allows unprivileged attackers to remotely access internal services or cloud metadata configurations on unpatched instances. According to **MLflow**'s security team, the default **MLflow Tracking Server**, when operating without authentication and using a default SQLite backend, exposes the model-registry webhooks API. This includes a synchronous `POST /api/2.0/mlflow/webhooks/{id}/test` endpoint that returns upstream response status and body to the caller. This exposure enables an unauthenticated attacker to compel the server to issue HTTP requests to arbitrary internal, loopback, or cloud-metadata endpoints. The attacker can then read the responses via the `/test` endpoint, potentially accessing sensitive information such as **AWS Identity and Access Management (IAM)** credentials from cloud instance-metadata, internal-only admin services, and internal port/host scanning results. Successful exploitation can lead to the theft of cloud credentials through low-complexity attacks. ### Added to CISA's KEV Catalog On Wednesday, CISA added **CVE-2026-64849** to its [catalog of known exploited vulnerabilities](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-64849). This move mandates U.S. Federal Civilian Executive Branch (FCEB) agencies to secure their **MLflow** instances within two weeks, in accordance with Binding Operational Directive 26-04. **BOD 26-04**, issued in June, prioritizes patching for vulnerabilities that are publicly exposed, listed in CISA's KEV catalog, automatable for large-scale attacks, or grant attackers partial or total system control upon exploitation. While CISA has not yet disclosed specifics of the ongoing attacks, cybersecurity firm **watchTowr** reported on Wednesday that threat actors began scanning for vulnerable **MLflow** systems mere hours after the CVE ID was assigned. **watchTowr** warned that attackers are exploiting the flaw to directly access cloud metadata services and exfiltrate cloud credentials and secrets. Organizations running **MLflow** are strongly advised to prioritize patching any exposed systems, meticulously review audit logs for signs of compromise, and verify whether sensitive credentials may have been exposed. This incident follows another recent CISA warning regarding the exploitation of a critical remote code execution (RCE) flaw in the **Windows Internet Key Exchange (IKE) Service Extensions** component.