CISA KEV Alert: CVE-2026-64849 — MLflow Server-Side Request Forgery Vulnerability...

Executive Summary

The CISA KEV catalog now lists CVE‑2026‑64849, a Server‑Side Request Forgery (SSRF) flaw in MLflow that enables attackers to query internal or cloud metadata services and retrieve response data. All MLflow deployments must be evaluated for internet exposure and patched or mitigated before the federal remediation deadline of 2026‑09‑02. Immediate executive action is required to authorize remediation, update change‑management processes, and notify affected business units.

Verified Facts

• MLflow contains a server‑side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body — CISA KEV entry.
• The vulnerability was added to the KEV catalog on 2026‑08‑19 with a federal remediation deadline of 2026‑09‑02 — CISA KEV entry.
• Vendor mitigation guidance is provided via a GitHub pull request (24258) and issue discussion (24179) — CISA Notes.

Threat Classification

Threat type: Server‑Side Request Forgery (SSRF) vulnerability (CWE‑918). Affected sectors: any organization deploying MLflow for model tracking, notably finance, healthcare, and cloud‑native enterprises. Geographic scope: global, as MLflow is open‑source and used worldwide. Exploitation status: active exploitation confirmed — HIGH CONFIDENCE. Attacker motivation: data exfiltration from internal services and potential pivot to further compromise — MEDIUM CONFIDENCE.

Threat Severity Assessment

• Exploitability: The SSRF can be triggered remotely against exposed MLflow endpoints, enabling internal service enumeration — HIGH CONFIDENCE.
• Scope of impact: MLflow is widely adopted in data‑science pipelines; any unpatched instance is vulnerable — HIGH CONFIDENCE.
• Prevalence: The vulnerability is listed in the KEV catalog, indicating known exploitation in the wild — HIGH CONFIDENCE.
• CVSS score: Not provided in the source material — MEDIUM CONFIDENCE (absence of score reduces quantitative assessment).

Overall severity: CRITICAL

Business Impact

Successful SSRF attacks can disclose internal metadata (e.g., AWS IAM credentials) leading to credential theft, lateral movement, and potential breach of regulated data, exposing the organization to GDPR fines up to €20 million or 4 % of global turnover, NIS2 enforcement actions, and DORA penalties for financial services. Operationally, compromised MLflow servers can halt model deployment pipelines, causing production downtime and revenue loss. Public disclosure of a breach stemming from this flaw would erode customer trust and damage brand reputation.

Technical Analysis

• Attack vector: Remote HTTP request to an unprotected MLflow endpoint that processes user‑supplied URLs.
• Exploitation chain: Attacker submits a crafted URL pointing to an internal metadata service (e.g., 169.254.169.254); MLflow server performs the request and returns the response_status and response_body to the attacker.
• Affected component: MLflow server request handling logic (specific code paths referenced in GitHub PR #24258).
• Root cause: Insufficient validation of outbound request destinations, leading to SSRF — CWE‑918.
• Versions impacted: All versions prior to the mitigation commit referenced in the GitHub pull request; exact version numbers are not enumerated in the source.

CVE Analysis

• CVE‑2026‑64849 — MLflow SSRF vulnerability — CWE‑918 — Network‑based attack vector — No authentication required to trigger the request — Mitigation available via vendor‑provided patch in GitHub PR #24258.

MITRE ATT&CK Mapping

• Initial Access → T1190: Exploit Public‑Facing Application — the SSRF flaw allows an external actor to interact with internal services through the MLflow web interface.
• Discovery → T1016.001: System Network Configuration Discovery — attackers can query internal metadata endpoints to enumerate network configuration.

IOC Intelligence

No public IOCs confirmed at time of publication.

Behavioral IOC categories for rule creation:

• Outbound HTTP/S requests from the MLflow server process to IP ranges reserved for cloud metadata services (e.g., 169.254.0.0/16).
• HTTP response payloads containing known metadata keys such as “iam/security‑credentials/” or “metadata/instance‑id”.
• Unusual URL parameters in MLflow API calls that contain “http://” or “https://” pointing to internal IPs.
• Repeated failed attempts to access the MLflow endpoint from external source IPs followed by successful internal requests.

Detection Engineering Guidance

• Collect Sysmon Event ID 3 (NetworkConnection) and filter where Image = “mlflow.exe” (or the MLflow service binary) and DestinationIp in 169.254.0.0/16.
• Enable web server access logs (e.g., Nginx/Apache) and alert on query parameters containing “http://169.254.” or “https://169.254.”.
• In cloud environments, ingest VPC Flow Logs and create alerts for traffic from the MLflow host to metadata service IPs.
• Correlate Azure/AWS CloudTrail events showing “GetInstanceMetadata” API calls originating from the MLflow instance’s IAM role.
• Use endpoint detection and response (EDR) telemetry to flag processes that spawn outbound HTTP requests without prior user interaction.

Sigma Rules

title: MLflow SSRF to Cloud Metadata Service
id: 3f9c2d1e-8b4a-4f6a-9c2e-1a2b3c4d5e6f
status: stable
description: Detects outbound network connections from MLflow to known cloud metadata IP ranges, indicative of SSRF exploitation.
author: CYBERDUDEBIVASH Sentinel APEX
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        Image|endswith: '\mlflow.exe'
        DestinationIp|cidr: '169.254.0.0/16'
    condition: selection
falsepositives:
    - Legitimate health‑check scripts accessing metadata
level: high
tags:
    - attack.t1190
    - attack.t1016.001

Threat Hunting Queries

• Hypothesis: MLflow server is issuing HTTP requests to internal metadata services — Source: Sysmon Event ID 3 where Image contains “mlflow” and DestinationIp in 169.254.0.0/16.
• Hypothesis: Web server logs contain suspicious query parameters targeting internal IPs — Source: Nginx access_log where request_uri matches “*http://169.254.*”.
• Hypothesis: Cloud Flow Logs show traffic from MLflow host to metadata endpoint — Source: VPC Flow Logs where src_ip = MLflow host IP and dst_ip = 169.254.169.254.
• Hypothesis: Azure/AWS CloudTrail records “GetInstanceMetadata” actions initiated by the MLflow service principal — Source: CloudTrail event name “GetInstanceMetadata”.
• Hypothesis: EDR alerts for processes spawning outbound HTTP connections without user interaction — Source: EDR telemetry where process_name = “mlflow” and network_connection = true and parent_process = “services.exe”.

SOC Analyst Playbook

• P0 (0‑1 hr): Verify existence of MLflow instances; pull latest patch from GitHub PR #24258 and apply to all production servers.
• P0: Block outbound traffic from MLflow hosts to 169.254.0.0/16 at the firewall while patching.
• P1 (1‑4 hr): Query Sysmon and web server logs for evidence of SSRF attempts using the detection queries above; document any findings.
• P1: If successful exploitation is observed, initiate incident response playbook for credential exposure and lateral movement.
• P2 (same‑day): Update asset inventory to flag MLflow as a high‑risk service; ensure change‑management tickets reflect the remediation deadline.

Executive Decision Matrix

🔗 Related Intelligence Reports

• Related topic: Simple Scans for Cloud Metadata Service, (Wed, Aug 19th)
• Related topic: CareCloud Data Breach Impact Grows to 3.7 Million Individuals
• Related topic: CISA Warns Hackers Are Actively Exploiting VMware vCenter Path Traversal Flaw
• Related topic: CVE-2026-75915 — CVSS 7.5 HIGH Severity | NVD Vulnerability Record
• Related topic: CISA Adds Four Known Exploited Vulnerabilities to Catalog