Critical SSRF in MLflow (CVE‑2026‑64849) Enables Unauthenticated Cloud Credential Theft
What It Is – MLflow versions < 3.15.0 contain a server‑side request forgery (SSRF) flaw (CVE‑2026‑64849) that lets an unauthenticated attacker force the MLflow server to issue arbitrary HTTP requests.
Exploitability – The vulnerability scores 9.3 (CVSS v3.1) and is already being weaponised in the wild. WatchTowr reports active scanning and exploitation within hours of the CVE’s public disclosure.
Affected Products – MLflow (open‑source machine‑learning workflow manager) prior to version 3.15.0.
Why It Matters for Compliance & Audit Readiness
- SOC 2 Access Controls – Unauthenticated SSRF bypasses logical access boundaries, violating the CC6.1 (Logical Access) and CC6.2 (Least Privilege) criteria.
- Continuous Monitoring – Detecting anomalous outbound requests from MLflow servers provides concrete audit evidence that controls are operating as intended.
- Defensible Audit Trail – Demonstrating timely patching and evidence of network‑segmentation mitigations satisfies the CC7.1 (Change Management) and CC7.2 (Vulnerability Management) requirements that auditors now expect from AI/ML workloads.
Recommended Actions
- Upgrade all MLflow deployments to ≥ 3.15.0 immediately.
- Enforce outbound‑traffic restrictions (e.g., deny access to cloud metadata endpoints) via network policies or host‑based firewalls.
- Enable logging of all outbound HTTP requests from MLflow nodes and feed these logs into a SIEM for continuous control monitoring.
- Review and tighten IAM policies for any cloud credentials that could be exposed via metadata services.
- Document the remediation steps in your SOC 2 evidence repository to demonstrate due diligence.
Source: SecurityAffairs – CISA adds an MLflow flaw to its KEV catalog