Overview
- A DNS-rebinding server-side request forgery in MLflow tracked as CVE-2026-64849 lets an unauthenticated attacker force the tracking server to make HTTP requests to internal services and cloud metadata endpoints.
- The bug was fixed in MLflow 3.15.0, but attackers began scanning and exploiting exposed instances within hours of the CVE assignment, aiming to harvest cloud credentials such as AWS IAM tokens.
- CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on Wednesday, which triggered the two-week remediation order for U.S. federal civilian agencies under Binding Operational Directive 26-04.
- Defenders are urged to apply the MLflow 3.15.0 patch, remove or restrict public exposure of tracking servers, review audit logs for signs of server-side request activity, and hunt for credential theft indicators.
- MLflow is widely used and often run with default, unauthenticated tracking servers, so unpatched instances increase risk of broader cloud compromise when temporary metadata credentials are exposed.