Threat Intelligence1 min read·
MLflow SSRF Exploitation: CVE-2026-64849 & Cloud Credential Theft
Critical unauthenticated SSRF (CVE-2026-64849) in MLflow allows cloud credential theft. Learn about active exploitation, technical details, and urgent mitigations for this AI platform vulnerability.
A critical unauthenticated Server-Side Request Forgery (SSRF) vulnerability, CVE-2026-64849, is under active exploitation in MLflow, enabling threat actors to exfiltrate highly sensitive cloud credentials and other internal data. Within hours of its assignment on August 17, 2026, security firm watchTowr's global honeypot network,
Want this expertise working for your team?
Schedule a 30-minute call and we'll walk through your specific security posture.
Book a consultation