MLflow CVE-2026-64849: Cloud Credential Theft via Webhook SSRF

Basic Information

• Article Title: Unauthenticated SSRF in MLflow Webhooks
• Publisher: MLflow Security Advisory / CISA
• Publication Date: 2026-08-19
• Severity: Critical
• Original Source: MLflow Security Advisory / CISA
• Related Sources: CISA warns of hackers exploiting critical MLflow vulnerability, MLflow Vulnerability Exploited for Cloud Credential Theft
• Related Malware: None / Unidentified
• Threat Actor: None / Unidentified
• CVE: CVE-2026-64849
• Products & Technologies: MLflow Tracking Server, AWS EC2 Instance Metadata Service
• Primary Target CVE: CVE-2026-64849

Summary

An attack that uses unauthenticated webhook creation and testing features to bypass protections via redirects or DNS re-resolution, allowing attackers to read cloud metadata and internal services.

Reason for Severity: It reaches tracking servers in default configurations without authentication, leads to cloud IAM credential theft, and is actively exploited and added to the CISA KEV list.

Attack Flow

Reading Internal Information via Reflected SSRF

• The attacker finds an externally exposed MLflow Tracking Server.
• They use an unauthenticated API to create a webhook pointing to the attacker's public HTTPS server.
• The public server sends a 302 redirect to cloud metadata or internal URLs.
• MLflow checks only the original URL and accesses the redirect target without re-evaluating it.
• The webhook test response returns the internal response body, exposing IAM role credentials and other data to the attacker.

Blind Write / DNS Rebinding

• 307/308 redirects maintain the POST method, enabling blind writes to internal services.
• Alternatively, DNS responses switch from public IPs to internal IPs, exploiting the gap between validation time and connection time.
• This can expand to internal port scanning, configuration changes, and internal API operations.

Attacker Position and Execution Location

• External attackers who can reach the MLflow Web UI/API from the internet.
• Connecting to metadata and internal services in the same cloud or network, using the MLflow server as a stepping stone.

Visibility for Victims and Administrators

Victims and Users

• No user action is required. Public MLflow servers are directly targeted.

Administrators and SOCs

• Suspicious webhook creation and testing, redirects from external URLs to internal or link-local IPs, and metadata API responses serve as clues.
• After a compromise, API calls using the MLflow server's cloud role may be visible.

Success and Failure Conditions

Success Conditions

• Vulnerable MLflow 3.14.0 or earlier.
• Webhook API on the Tracking Server is reachable without authentication.
• Network communication is possible from the MLflow host to internal services/metadata.
• The cloud role has valid permissions, increasing the impact after credential theft.

Failure Conditions

• Updating to MLflow 3.15.0 or later.
• Making MLflow private from the internet and protecting it with an authenticated reverse proxy or similar methods.
• Metadata service protections, least-privilege roles, and egress controls.
• Validating webhook destination IPs after connection and at each redirect.

What Happens Upon Success

• Reading cloud metadata and temporary IAM credentials.
• Retrieving internal service information, port scanning, and blind writes.
• Accessing cloud assets within the privilege scope of the stolen credentials.

Observable Logs

Email is not an attack vector.

Proxy / SWG / DNS

• Connections to 169.254.169.254 or RFC1918 addresses immediately following a connection from MLflow to the attacker's public host.
• DNS responses for the same hostname change from public IPs to internal IPs in a short time.

Endpoint / EDR

• HTTP connections from the MLflow process to internal networks/metadata. Network telemetry is important because this usually happens without additional processes.

Identity / IdP

• API usage from new IPs and User-Agents using stolen temporary cloud credentials.

SaaS / Cloud

• Abnormal enumeration of MLflow roles, retrieval of secrets, or resource operations in CloudTrail, etc.
• IMDS access logs or host network flows.

Network

• HTTP connections from the MLflow server to link-local, loopback, RFC1918, and internal management ports.

Attack Success Determination

• Attack Attempt Observed (Success Unconfirmed): Only suspicious requests or vulnerability scans against the webhook API. Internal connections and response retrievals are not confirmed.
• Initial Execution Confirmed: Webhooks are created and tested, and the MLflow server connects to the specified URL.
• Information Theft or Session Compromise Confirmed: Metadata/IAM credential responses are returned, or cloud API usage with stolen credentials is confirmed.
• Post-Compromise Activity Confirmed: Secret retrieval, lateral movement, or resource modifications using the stolen role are confirmed.

"Attack Attempt Observed (Success Unconfirmed)" means suspicious requests or payloads are identified, but code execution or information theft is not established. Escalate the severity based on subsequent evidence.

Investigation Playbook

Trigger

• Anonymous access to the MLflow Webhook API.
• Connections from the MLflow host to 169.254.169.254 or internal management APIs.
• MLflow cloud roles used from unknown IPs.

Initial Check

• Check the version, public exposure scope, webhook list, creator, creation time, and test history.
• Recover the URL, redirect chain, DNS responses, and final connection IP.

Endpoint

• Preserve MLflow process connection history, application logs, and reverse proxy logs.
• Do not rule out SSRF just because there are no file creations or child processes.

Authentication and Cloud

• Investigate role sessions, CloudTrail, secret access, and permission changes starting from the webhook timestamp.
• Revoke/rotate the compromised role credentials and apply least privilege.

Subsequent Operations

• Search for operations across all regions using the same IP, User-Agent, and Access Key ID.

Containment

• Make MLflow private or restrict access, and update to version 3.15.0 or later.
• Disable/delete webhooks, and rotate role credentials and any exposed secrets.

Determination Categories

• Attack attempt only
• Outbound SSRF connection confirmed
• Internal response retrieval confirmed
• Credential theft confirmed
• Subsequent cloud compromise confirmed

Defense and Detection Ideas

Single Event

• Anonymous webhook creation/testing.