# Hackers Are Already Exploiting a Critical Flaw in AI Tool MLflow > Source: > Published: 2026-08-24 03:48:51+00:00 A dangerous security gap in one of the world’s most widely used AI development platforms is now being actively abused, and cybersecurity researchers say the window for organizations to protect themselves is closing fast. [Hackers](https://www.kobaran.com/tag/Hackers) began targeting the vulnerability within hours of its public disclosure, turning what should have been a routine patch cycle into an urgent race against time. MLflow, an open-source platform used to build and manage machine learning models, agents, and large language model applications, sits at the center of the issue. The platform’s own website states that thousands of organizations rely on it, including major names like Meta, Accenture, and Microsoft, which makes the scale of potential exposure significant. What makes this situation especially concerning is not just the technical severity of the flaw itself, but how quickly hackers moved to weaponize it. Security teams are now scrambling to determine whether their systems have already been compromised, even as they work to apply the fix. ## What Is CVE-2026-64849 and Why Does It Matter ### The Vulnerability Explained The security flaw, tracked as CVE-2026-64849, is classified as a critical unauthenticated Server-Side Request Forgery (SSRF) vulnerability. It affects every version of MLflow released before version 3.15.0, meaning any organization running an older build is potentially at risk. The bug was first disclosed on August 2 but did not receive its official CVE designation until August 17, weeks later. That gap between disclosure and formal cataloging is notable because hackers do not wait for paperwork. According to threat intelligence gathered from global honeypot networks, exploitation attempts began almost immediately after the flaw became public knowledge. ### How the Exploit Works At the technical level, the vulnerability stems from an inconsistency in how MLflow validates webhook URLs. Prior to version 3.15.0, the platform’s webhook testing endpoint checked the safety of a URL only once, at the very beginning of the request. However, a separate part of the system that actually delivers webhook data follows redirects and re-resolves hostnames without re-checking whether the new destination is safe. This inconsistency creates an opening. An attacker can submit a URL that initially passes MLflow’s validation check, then redirect the request to an internal address or a cloud metadata service, one of the most sensitive targets in any cloud environment. Because the system does not “pin” or lock in the originally validated address, it ends up connecting to wherever the redirect points, and then hands back the response data, including status codes and body content, to the attacker. Yordan Ganchev, principal threat intelligence specialist at cybersecurity firm watchTowr, described the mechanism in direct terms. He explained that the flaw allows an attacker to exploit MLflow’s model-registry webhooks to proxy requests through an affected system and interact with internal services, and noted that the bug specifically bypasses earlier fixes because of how it handles web redirects. Ganchev added that watchTowr’s global honeypot telemetry shows hackers actively abusing the vulnerability to target cloud-hosted MLflow systems, with the apparent goal of extracting credentials and secrets from well-known internal IP addresses and services. ## Why Cloud Metadata Access Is the Real Danger ### The Credential Theft Risk The most alarming aspect of this vulnerability is not the initial access point but what it can lead to. Cloud metadata services are internal endpoints that cloud providers use to supply temporary credentials to applications running on their infrastructure. If hackers can trick a vulnerable MLflow instance into querying those services on their behalf, they may walk away with valid cloud credentials, without ever needing a username or password. Robbie Mueller, a solutions engineer at security governance firm ArmorCode, weighed in after the Cybersecurity and Infrastructure Security Agency (CISA) issued a warning directing US federal agencies to address the issue without delay. Mueller cautioned against estimating an organization’s exposure based purely on download numbers, pointing out that MLflow is deployed broadly across AI and machine learning environments that can span development, research, engineering, and production systems alike. He noted that gauging how many organizations are truly affected is difficult when many companies lack accurate asset inventories, particularly around which of these systems are exposed to the internet. ### A Worst-Case Scenario Mueller laid out a chain of events that security teams should be actively guarding against. In his assessment, one possible worst-case scenario begins with hackers exploiting an MLflow instance, then using that foothold to retrieve cloud credentials or secrets. From there, attackers could begin enumerating the broader cloud environment in search of additional resources to access. Depending on the permissions tied to the compromised identity, Mueller said the consequences could escalate to include exposure of sensitive data, storage systems, secrets, additional workloads, and even cloud management APIs. He added that from that point, hackers could attempt data exfiltration, move laterally through connected systems, and cause broader damage across an organization’s environment. ## What Organizations Should Do Now ### Immediate Patching Guidance Security experts are unanimous on one point: organizations running MLflow versions prior to 3.15.0 should patch immediately. MLflow’s maintainers confirmed the issue is fixed in version 3.15.0, and given that hackers are already exploiting the flaw in the wild, delaying the update carries real risk. The table below summarizes the key facts organizations need to know. | Detail | Information | |---|---| | Vulnerability ID | CVE-2026-64849 | | Severity | Critical (Unauthenticated SSRF) | | Affected Versions | All versions prior to 3.15.0 | | Disclosed | August 2 | | CVE Assigned | August 17 | | Exploitation Status | Actively exploited by hackers | | Fixed Version | 3.15.0 | | Federal Guidance | CISA has directed US agencies to remediate | ### Beyond Patching: Compensating Controls For organizations that cannot patch immediately due to operational constraints, Mueller stressed the importance of having a broader exposure management strategy in place. He recommended that companies unable to patch right away should enable compensating controls and enforce least-privilege principles to limit the potential damage hackers could inflict even if they gain initial access. This means restricting the permissions assigned to cloud identities connected to MLflow instances, closely monitoring for unusual internal network requests, and ensuring that internet-facing MLflow deployments are properly inventoried and locked down. ### Why This Story Is Still Developing Given the active exploitation confirmed by independent threat intelligence and the federal government’s involvement through CISA, this situation is likely to evolve over the coming days. Organizations that have already been compromised may only discover the breach after attackers have moved further into their cloud environments, which means incident response activity and follow-up disclosures are expected to continue. Security teams are advised to monitor official channels from MLflow, CISA, and cybersecurity vendors tracking this campaign for updates on indicators of compromise and further guidance.