CVE-2026-64849 · High · CISA KEV

MLflow SSRF: Internal Service Exposure via Server-Side Request Forgery

Threat Engine Auto-Feed · data current as of 2026-08-20

CVE-2026-64849, a server-side request forgery (SSRF) in MLflow, is actively exploited in the wild. This vulnerability allows attackers to access internal or cloud metadata services, potentially exposing sensitive response data. Its presence in the CISA KEV catalog indicates a critical need for immediate attention.

  • CVSS:
  • EPSS percentile: 0.6328
  • Exploitation pressure: 63/100 (High)

Exploitation reality: listed in CISA KEV (exploited in the wild) · EPSS 63th percentile. Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

Server-Side Request Forgery (SSRF) occurs when a web application fetches a remote resource without properly validating the user-supplied URL. This allows an attacker to trick the application into making requests to arbitrary internal or external systems, potentially exposing sensitive data or enabling further attacks.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Organizations using MLflow in their machine learning pipelines, especially those with cloud-hosted or complex internal network architectures.
  • Financial services and Technology sectors, given the documented targeting by financially motivated and state-sponsored threat actors.

Misconfigurations that escalate it

  • MLflow deployments with inadequate network segmentation between the application and internal/cloud metadata services.
  • Lack of egress filtering or allow-listing for MLflow's outbound connections, permitting arbitrary internal requests.

High-impact scenarios

  • Attackers gaining unauthorized access to sensitive internal network services or cloud metadata, leading to data exfiltration or credential theft.
  • Compromise of cloud infrastructure or internal systems by leveraging information obtained through the SSRF, enabling lateral movement and broader system impact.

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor MLflow application logs for unusual outbound connection attempts or requests to internal IP addresses/metadata service endpoints.
  • Implement network intrusion detection systems (NIDS) to flag suspicious traffic originating from MLflow instances towards internal or cloud service IPs.
  • Regularly review MLflow configurations for any unauthorized changes or exposed endpoints.

Contain

  • Isolate affected MLflow instances from the network to prevent further internal reconnaissance or data exfiltration.
  • Block outbound connections from MLflow to internal network segments and cloud metadata services, allowing only strictly necessary communications.

Patch

  • Apply the latest security patches or updates provided by MLflow to address CVE-2026-64849.
  • If a patch is not immediately available, consider implementing strong egress filtering and network segmentation as a compensating control.

Frontier verdict — High

High priority due to active exploitation (CISA KEV) and potential for significant internal network/cloud service compromise, especially for financial and technology sectors.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.