CISA Adds One Known Exploited Vulnerability to Catalog

Executive Summary

The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE‑2026‑64849, an MLflow Server‑Side Request Forgery (SSRF) flaw, to its Known Exploited Vulnerabilities (KEV) Catalog, confirming active exploitation in the wild. Federal agencies and any organization exposing MLflow services to the internet must prioritize immediate remediation to avoid total control of the affected asset. Decision makers must authorize emergency patch deployment, validate exposure of MLflow endpoints, and trigger incident‑response verification before patching.

Verified Facts

• CISA added CVE‑2026‑64849 (MLflow SSRF) to the KEV Catalog based on evidence of active exploitation — CISA Advisory.
• Binding Operational Directive (BOD) 26‑04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of KEV‑listed vulnerabilities on publicly exposed assets — CISA Advisory.
• CISA invites external submissions of exploited vulnerabilities for potential KEV inclusion via a nomination form — CISA Advisory.

Threat Classification

Threat type: Server‑Side Request Forgery (SSRF) vulnerability exploitation (HIGH CONFIDENCE). Affected sector: Federal civilian agencies and any private entities running publicly accessible MLflow instances (MEDIUM CONFIDENCE). Geographic scope: United States federal network and any globally reachable MLflow deployments (MEDIUM CONFIDENCE). Exploitation status: Active exploitation confirmed by CISA (HIGH CONFIDENCE). Attacker motivation: Obtain unrestricted network access and potentially pivot to internal systems (MEDIUM CONFIDENCE).

Threat Severity Assessment

• Exploitability: The SSRF flaw enables remote actors to force the server to issue arbitrary HTTP requests, a technique widely leveraged in the wild (HIGH CONFIDENCE).
• Scope of impact: A successful exploit grants total control of the compromised MLflow host, exposing model data, credentials, and internal network resources (HIGH CONFIDENCE).
• Prevalence: CISA’s inclusion in the KEV Catalog indicates confirmed exploitation across multiple instances (HIGH CONFIDENCE).
• CVSS: Not published in the advisory; however, the combination of remote code execution potential and full asset control warrants a CRITICAL rating (MEDIUM CONFIDENCE).

Business Impact

• Operational disruption: An exploited MLflow server can be leveraged to exfiltrate proprietary ML models, corrupt training pipelines, or launch lateral movement, halting AI‑driven business processes.
• Regulatory liability: Federal agencies failing to remediate within BOD 26‑04 timelines risk non‑compliance penalties under the Federal Information Security Modernization Act (FISMA) and could incur audit findings.
• Financial exposure: For commercial entities, loss of intellectual property or downtime could trigger breach notification costs exceeding $500,000 under state data‑breach statutes.
• Reputational damage: Public disclosure of compromised ML models erodes stakeholder trust and may affect market valuation for AI‑centric firms.

Technical Analysis

• Attack vector: Remote attacker sends crafted HTTP requests to the MLflow server that trigger SSRF, causing the server to issue arbitrary outbound connections.
• Exploitation chain: Malicious URL → MLflow endpoint → SSRF payload → internal service request → attacker‑controlled response.
• Affected component: MLflow server component handling user‑supplied URLs (e.g., artifact tracking or model registry APIs).
• Root cause: Insufficient validation of user‑controlled URL parameters, allowing external input to dictate outbound network calls (CWE‑918 SSRF).
• Patch status: CISA advisory does not specify patch availability; organizations must monitor vendor bulletins for remediation releases.

MITRE ATT&CK Mapping

• Initial Access → T1190: Exploit Public-Facing Application — the SSRF flaw is used to gain initial foothold on the MLflow service.
• Execution → T1041: Exfiltration Over Command and Control Channel — attackers can leverage the forged request to tunnel data out of the network.
• Lateral Movement → T1021: Remote Services — SSRF can be used to reach internal services behind firewalls.

IOC Intelligence

No public IOCs confirmed at time of publication.

Behavioral hunting indicators:

• Unusual outbound HTTP/S requests originating from the MLflow server to internal IP ranges not normally contacted.
• Repeated failed URL validation errors in MLflow logs indicating malformed external URLs.
• Anomalous DNS queries for internal hostnames generated by the MLflow process.
• Spike in network traffic from the MLflow host to cloud metadata services (e.g., 169.254.169.254).

Detection Engineering Guidance

• Collect MLflow application logs (e.g., mlflow.log) and forward to the SIEM; monitor for log entries containing external URLs in request parameters.
• Enable Web Server (NGINX/Apache) access logs for the MLflow endpoint; flag HTTP requests where the Host header or query string contains IP addresses outside the organization’s CIDR.
• Enable Windows Sysmon Event ID 3 (Network Connection) or Linux auditd execve events on the MLflow host; alert on outbound connections to private IP ranges initiated by the mlflow process.
• Correlate DNS query logs from the MLflow host for internal domain names that resolve to unexpected IPs.
• Deploy a rule that triggers when the same source IP repeatedly sends requests to the MLflow endpoint with differing external URL parameters within a 5‑minute window.

Sigma Rules

title: MLflow Server-Side Request Forgery Attempt
id: 9f2c1e3b-4d5a-4f9b-8a2e-6c7d9e1f2b3c
status: stable
description: Detects crafted HTTP requests to MLflow that contain external URLs, indicative of SSRF exploitation.
author: CYBERDUDEBIVASH Sentinel Apex
logsource:
    product: nginx
    service: webserver
detection:
    selection:
        cs-uri-query|contains: "http://"
        cs-uri-query|contains: "https://"
        cs-uri-query|contains: "://"
    filter_internal:
        cs-uri-query|contains: "10."
        cs-uri-query|contains: "192.168."
        cs-uri-query|contains: "172.16."
    condition: selection and not filter_internal
falsepositives:
    - Legitimate external artifact URLs
level: high
tags:
    - attack.t1190

Threat Hunting Queries

• Hypothesis: MLflow server is issuing outbound requests to internal services via SSRF — Source: NetFlow logs; query for traffic from mlflow process IP to private CIDR on ports 80/443.
• Hypothesis: Malicious URLs are being logged in MLflow request parameters — Source: MLflow application logs; search for regex https?://[^\s]+ in request_params field.
• Hypothesis: Unexpected DNS lookups from the MLflow host to internal hostnames — Source: DNS server logs; filter for queries where client_ip equals MLflow host IP and query_name matches internal domain pattern.
• Hypothesis: Repeated failed URL validation errors indicate probing — Source: Web server error logs; count occurrences of status code 400 with message containing “invalid URL”.
• Hypothesis: Lateral movement attempts using SSRF to reach internal APIs — Source: Sysmon Event ID 3; filter for network connections where Image is “mlflow” and DestinationIp is within internal range.

SOC Analyst Playbook

• P0 – Immediate (0‑1 hr): Verify if any MLflow instances are publicly reachable; block external access via firewall ACLs.
• P0 – Immediate (0‑1 hr): Pull latest MLflow logs and search for external URL patterns; isolate any host showing suspicious entries.
• P1 – Urgent (1‑4 hr): Query NetFlow/Sysmon for outbound connections from the MLflow host to private IPs; document findings.
• P1 – Urgent (1‑4 hr): Check vendor advisories for patch availability; if patch exists, begin staged deployment on a test system.
• P2 – Same‑day (4‑8 hr): Update IDS/IPS signatures to detect SSRF payload patterns; notify change‑management for emergency patch rollout.

Executive Decision Matrix

Executive Recommendations

• Day 1‑7: Block public access to MLflow

🔗 Related Intelligence Reports

• Same vulnerability: CISA KEV Alert: CVE-2026-64849 — MLflow Server-Side Request Forgery Vulnerability | Active
• Related topic: CISA Warns Hackers Are Actively Exploiting VMware vCenter Path Traversal Flaw
• Related topic: CISA Adds Four Known Exploited Vulnerabilities to Catalog
• Related topic: CISA KEV Alert: CVE-2026-65400 — Apple macOS Improper Authentication Vulnerability | Activ
• Related topic: CISA KEV Alert: CVE-2026-55040 — Microsoft SharePoint Weak Authentication Vulnerability |