The Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability in the MLflow AI platform to its catalog of flaws exploited in the wild, warning federal agencies that threat actors are actively targeting it. The flaw, tracked as CVE-2026-64849, is a DNS-rebinding server-side request forgery bypass in MLflow's outbound webhook delivery. It was patched in version 3.15.0 and can be exploited without privileges to reach internal services or cloud metadata on unpatched systems.
MLflow is an open-source AI engineering platform backed by the Linux Foundation, used for managing large language models and agents. It sees over 30 million monthly downloads and is used by thousands of organizations to debug, evaluate, optimize, and monitor AI applications. The platform's security team said the default tracking server configuration exposes the model-registry webhooks API without authentication, including a test endpoint that returns upstream responses to the caller. This lets an unauthenticated attacker make the server issue HTTP requests to arbitrary internal, loopback, or cloud-metadata endpoints.
The advisory from MLflow's security team, issued three weeks before CISA's warning, detailed that an attacker can read responses from those requests, including cloud instance metadata such as AWS Identity and Access Management credentials. The flaw also allows scanning of internal ports and hosts, and accessing internal-only admin services behind network boundaries. Successful exploitation can lead to theft of cloud credentials in low-complexity attacks, according to the source.
On Wednesday, CISA ordered U.S. Federal Civilian Executive Branch agencies to secure their MLflow instances within two weeks, as required by Binding Operational Directive 26-04. That directive, issued in June, mandates prioritization of patching for publicly exposed assets, flaws in CISA's Known Exploited Vulnerabilities catalog, vulnerabilities that can be automated for large-scale attacks, and those that give attackers partial or total system control. While the directive applies only to government agencies, CISA urged all network defenders to prioritize patching against CVE-2026-64849.
CISA warned that this type of vulnerability is a frequent attack vector for malicious actors and poses significant risks to the federal enterprise. The agency said stakeholders must evaluate each asset's internet exposure and follow BOD 26-04 patching guidelines. This alert follows another from CISA on Tuesday, which warned that hackers are abusing a critical remote code execution flaw in the Windows Internet Key Exchange Service Extensions component.
The warning comes amid broader concerns about post-breach defenses, as highlighted by the Blue Report 2026, which measured defenses across 338 million simulations in production environments. That report found that prevention scores can hide what happens after initial access, with protection dropping sharply once attackers use valid credentials. The MLflow vulnerability highlights the risk of unauthenticated access to AI infrastructure, which is increasingly a target for malicious actors.
More cybersecurity news from TechManNews.
