Skip to content

MLflow CVE-2026-64849 SSRF: cloud-credential and secret exfiltration via model-registry webhooks

Summary

Two open-source products are under active malicious scanning and exploitation as of August 18, 2026, per independent reports from watchTowr and VulnCheck:

  • MLflow — CVE-2026-64849, a flaw in the model-registry webhooks that lets an attacker proxy requests through the affected system to interact with internal services. Attackers use it to reach cloud metadata services directly and exfiltrate cloud credentials and secrets.
  • FUXA (open-source web-based SCADA / HMI for OT and industrial automation) — CVE-2026-25895, a path traversal that an observed attacker uses to overwrite main.js with junk data (a destructive DoS vector; no RCE payload observed in the public reporting).

watchTowr detected attackers indiscriminately scanning for exposed MLflow instances online within hours of the CVE being assigned on August 17, 2026. Its global honeypot telemetry indicates the vulnerability is being abused to target cloud-hosted MLflow systems to extract credentials and secrets from well-known internal IP addresses and services.

Tags

MLflow — CVE-2026-64849

KEV status (added August 19, 2026): CISA listed CVE-2026-64849 in the Known Exploited Vulnerabilities catalog on August 19, 2026 — a day after watchTowr's public reporting — confirming the observed exploitation. CISA notes the SSRF "can allow attackers to reach internal or cloud metadata services and receive response_status and response_body" (CWE-918), with a BOD 26-04 due date of September 2, 2026 and the standard Forensics Triage Requirements for affected federal systems. CISA's notes link the vendor fix (PR #24258) and the originating issue (#24179).

Fix release: the fix — "Fix DNS-rebinding SSRF bypass in webhook delivery" (PR #24258, GHSA-7gwp-5pfp-969j) — shipped in MLflow v3.15.0 (July 31, 2026); v3.15.1 (August 3) does not add further webhook-SSRF changes. Upgrade to ≥ 3.15.0 to close this flaw.

Root cause (as described by watchTowr and CISA): a flaw in MLflow's model-registry webhooks allows an attacker to exploit it to proxy requests through the affected system and interact with internal services. Critically, the bug bypasses prior SSRF fixes because of how MLflow handles web redirects — a redirect-based SSRF regression.

Observed abuse: attackers use the proxy to reach cloud metadata services directly (e.g., well-known internal IP addresses and services such as cloud IMDS endpoints) and exfiltrate cloud credentials and secrets. Honeypot telemetry shows the exploitation targets cloud-hosted MLflow systems specifically.

Timeline: - Jul 31, 2026 — fix lands in MLflow v3.15.0 (PR #24258, GHSA-7gwp-5pfp-969j). - Aug 17, 2026 — CVE-2026-64849 assigned; scanning of exposed MLflow instances begins within hours. - Aug 18, 2026 — watchTowr public reporting. - Aug 19, 2026 — CISA adds CVE-2026-64849 to KEV (BOD 26-04 deadline September 2, 2026).

watchTowr guidance: prioritize patching affected, exposed systems; review audit logs for signs of compromise; and check whether sensitive credentials have been exposed (i.e., rotate cloud credentials/secret keys on any exposed instance, not just patch).

FUXA — CVE-2026-25895 (OT context)

Observed abuse: a single IP address has been observed broadly scanning the internet for vulnerable FUXA instances. The attacker's request attempts to overwrite main.js with junk data via the path-traversal flaw — a destructive vector that can brick or disrupt the HMI; no RCE payload was observed in the public reporting.

Exposure: about 60 FUXA installations are exposed to the public internet.

Timeline: - Aug 18, 2026 — VulnCheck detected malicious scanning; public reporting.

Why this matters

  • MLflow is a common piece of the ML/AI data-science stack and is frequently cloud-hosted with broad internal access. A redirect-bypass SSRF that reaches cloud metadata is a direct cloud credential / secret exfiltration primitive — the highest-value outcome for a scanner-driven mass campaign.
  • The redirect-handling regression means teams who applied the earlier SSRF fix are not safe; the fix surface is the redirect path, not just the original sink.
  • FUXA is OT/SCADA software; even a DoS-only path-traversal overwrite against ~60 internet-exposed installations is a resilience/availability risk in industrial environments.

Defender priorities

  1. Upgrade MLflow to ≥ 3.15.0 (fix in PR #24258) to close CVE-2026-64849; if you cannot patch immediately, restrict / remove the model-registry webhook functionality and egress-filter so the service cannot reach cloud metadata endpoints.
  2. Rotate cloud credentials and secrets on any exposed MLflow instance — assume exposure of instance metadata credentials, not just a pending patch.
  3. Hunt audit logs for outbound requests from the MLflow service to cloud metadata / well-known internal IPs (SSRF exfiltration pattern), and for webhook requests that follow redirects to internal destinations.
  4. FUXA: patch CVE-2026-25895; segment and restrict internet access to HMI/SCADA systems (ideally no direct internet exposure); verify main.js integrity after any suspected scan.
  5. Reduce the scan surface: inventory internet-exposed MLflow and FUXA deployments; expose neither publicly.

Assessment limits

  • Based on watchTowr and VulnCheck public reporting via The Hacker News, plus CISA KEV (Aug 19) and the MLflow fix PR; exact affected-version lower bound should be confirmed against the MLflow advisory (fix shipped in v3.15.0; earlier versions assumed affected).
  • FUXA abuse observed so far is destructive (file overwrite), not RCE; treat as a DoS/availability vector unless new evidence emerges.

Sources