Threat actors are actively targeting cloud-hosted MLflow deployments following the disclosure of CVE-2026-64849, an unauthenticated server-side request forgery (SSRF) flaw affecting all versions of the machine learning platform prior to 3.15.0.
watchTowr Intel reported that its Attacker Eye global honeypot network detected exploitation attempts within hours of the CVE being assigned.
The rapid activity suggests attackers are immediately scanning for exposed MLflow instances and attempting to abuse the vulnerability to access sensitive cloud resources, including credentials, API tokens, and application secrets.
Hackers Exploit MLflow SSRF Flaw
SSRF vulnerabilities allow an attacker to coerce a vulnerable server into issuing requests on their behalf. In cloud environments, this can be particularly dangerous because the compromised application may be able to reach internal-only services that are not exposed to the public internet.
Attackers commonly use SSRF flaws to probe private network services, access cloud metadata endpoints, and retrieve temporary identity credentials assigned to workloads.
In an MLflow deployment, successful exploitation could give an unauthenticated remote attacker a path to request resources accessible from the MLflow server’s network position.
Depending on the hosting environment and the workload’s permissions, the impact could include exposure of cloud access keys, instance identity tokens, service account credentials, environment variables, or secrets stored in reachable internal services.
The observed activity underscores a recurring risk for organizations deploying machine-learning infrastructure in cloud environments.
MLflow instances often sit close to high-value assets, including model-training data, experiment artifacts, source repositories, object storage, CI/CD systems, and production inference pipelines.
A compromised ML platform could therefore provide attackers with both immediate credentials and a foothold for lateral movement. Organizations running MLflow should prioritize upgrading to version 3.15.0 or later.
Internet-facing instances should be treated as urgent patching candidates, particularly where the service runs with cloud identity permissions or can access sensitive internal infrastructure. Security teams should also review logs for unusual outbound requests originating from MLflow servers.
Relevant indicators may include requests to cloud metadata services, connections to private IP ranges, unexpected DNS lookups, or anomalous access to internal APIs and secret-management platforms.
Teams should investigate authentication events and cloud audit logs for credential use that does not align with expected MLflow operations. Patching alone may not be sufficient where exploitation occurred before remediation.
Organizations should assess whether secrets, temporary cloud credentials, access tokens, or service-account identities could have been exposed. Any potentially compromised credentials should be revoked, rotated, or replaced, while access policies should be reviewed for excessive permissions.
Give your security team the visibility and context to investigate suspicious activity faster and contain threats before business impact grows. Strengthen Your Investigations with ANY.RUN
 flaw affecting all versions of the machine learning platform prior to 3.15.0.){kind=link}