CISA Alerts on Critical MLflow SSRF Vulnerability (CVE‑2026‑64849) Exploited in the Wild

CISA Alerts on Critical MLflow SSRF Vulnerability (CVE‑2026‑64849) Exploited in the Wild

What Happened — CISA issued a warning that threat actors are actively exploiting a critical server‑side request forgery (SSRF) flaw in the open‑source MLflow platform (CVE‑2026‑64849). The vulnerability allows unauthenticated callers to force the MLflow tracking server to issue arbitrary HTTP requests, enabling theft of cloud‑metadata credentials (e.g., AWS IAM keys). A patch was released in MLflow 3.15.0, and agencies have been ordered to remediate within two weeks.

Why It Matters for Compliance & Audit Readiness

• The flaw bypasses access‑control safeguards, a core SOC 2 CC6.1 (Logical Access) control that must be demonstrably enforced.
• Exploitation can lead to credential exposure, triggering the need for documented incident‑response evidence and continuous monitoring of privileged‑access assets.
• Verisq’s Control‑Mapping capability helps map this SSRF gap to SOC 2 controls, collect continuous evidence of patch status, and provide audit‑ready proof in a Trust Center dashboard.

Who Is Affected

• Technology & SaaS providers that embed MLflow for model tracking and webhook automation.
• Federal agencies and any organization running the default, unauthenticated MLflow tracking server.

Recommended Actions

• Verify MLflow version; upgrade all instances to ≥ 3.15.0 immediately.
• Disable unauthenticated webhook endpoints or enforce strong authentication (e.g., OAuth, mTLS).
• Add the MLflow server to your asset inventory and enable continuous vulnerability‑scan integration to capture future CVE exposure.
• Document the remediation steps and retain logs as evidence for SOC 2 audit trails.

Technical Notes

• Attack vector: Unauthenticated SSRF via /api/2.0/mlflow/webhooks/{id}/test endpoint.
• CVE: CVE‑2026‑64849, CVSS ≈ 9.8 (critical).
• Impact: Ability to read cloud‑metadata services (AWS IMDS) and internal admin APIs, leading to credential theft.
• Patch: Released in MLflow 3.15.0; mitigates by enforcing authentication and restricting outbound requests.

Source: BleepingComputer