CISA has added a bug in MLflow, the open source platform teams use to build, track and ship machine learning and large language model applications, to its Known Exploited Vulnerabilities catalog. The agency only lists an entry when it has evidence of active exploitation, so somebody is already using this one against real deployments.
The flaw is CVE-2026-64849, a server side request forgery issue rated CVSS 9.3. Server side request forgery means tricking a server into making a web request on the attacker's behalf, which is valuable precisely because the server can reach things the attacker cannot, starting with the internal network it sits on.
A webhook check that follows redirects
According to the CVE record, MLflow before version 3.15.0 exposes an unauthenticated endpoint, POST /api/2.0/mlflow/webhooks/{id}/test, for confirming that a webhook works. The URL handed to it is validated once, when it arrives. The delivery code then follows redirects and re-resolves the hostname without pinning the address that passed validation, so the request that actually leaves the server need not be the request that was checked. The record states this allows attackers to reach internal or cloud metadata services and receive back both the response status and the response body.
That last part is what raises the stakes. Cloud metadata services are the internal endpoints an instance queries to learn about itself, and on several platforms they will hand out temporary credentials for the role attached to that instance. Reading the response body, rather than merely learning that a request succeeded, is the difference between a blind probe and a readable one.
The second machine learning platform this week
MLflow is not an obscure component. It is the experiment tracking and model registry layer sitting in the middle of a great many corporate machine learning stacks, which means it tends to be deployed on internal infrastructure with credentials attached and, too often, an interface someone left reachable.
It is also the second piece of AI plumbing we have covered on the catalog this week. On August 17 we covered CISA's KEV addition for Ray, the distributed computing framework used to train models. The pattern worth noting is not that AI tools have bugs, but that the machinery around the models is now being exploited in the wild rather than merely researched, in the same way the supply chain around AI tooling has been.
Upgrade to MLflow 3.15.0
The issue is fixed in MLflow 3.15.0, and upgrading is the remediation. Because the vulnerable endpoint needs no authentication, an MLflow tracking server that is reachable from anywhere untrusted should be treated as the priority, and taking it off the open internet is worth doing regardless of patch state. Egress filtering that blocks instance metadata addresses is the usual second layer for this class of flaw.
In its alert, CISA points federal civilian agencies at Binding Operational Directive 26-04, which requires them to prioritize rapid remediation of KEV Catalog vulnerabilities on publicly exposed assets that grant total control of the asset post-exploitation, and to check whether threat actors compromised the system before the patch was applied. CISA encourages all organizations to adopt the same risk based approach, and for a component holding cloud credentials that advice is worth taking literally.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.