Loading story…
Attackers are actively exploiting CVE-2026-64849, a critical unauthenticated server-side request forgery flaw in MLflow’s webhook delivery logic, to steal credentials and sensitive data from exposed tracking server deployments. The vulnerability affects MLflow versions prior to 3.15.0 and abuses the default-enabled model-registry webhooks API, allowing crafted webhook requests to reach internal services and cloud metadata endpoints. Researchers reported exploitation within hours of the CVE being assigned, with attempts to extract secrets from addresses including 127.0.0.1 and 169.254.169.254.
The flaw stems from MLflow validating a webhook URL and then re-resolving or following redirect targets during delivery, enabling DNS rebinding or redirect-based access to non-public destinations. Successful exploitation can expose highly privileged credentials, including AWS IAM role credentials tied to EC2 instances or Kubernetes nodes, and may provide access to internal databases, configurations, and administrative tools. The vulnerability carries a CVSS 9.3 rating, and MLflow 3.15.0 addresses it by tightening destination validation and blocking non-global IP addresses; defenders are being urged to patch immediately and investigate whether secrets or cloud credentials were exposed.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
CISA updated its Known Exploited Vulnerabilities catalog on 2026-08-19 to add CVE-2026-64849, the MLflow server-side request forgery flaw. The listing confirms known exploitation and directs organizations to apply vendor mitigations under BOD 26-04 guidance.
VulnCheck detected malicious internet-wide scanning for FUXA CVE-2026-25895 on August 18, 2026. The activity targeted exposed FUXA instances with requests attempting to overwrite main.js via path traversal, though no remote code execution payloads had been observed yet.
A public GitHub issue disclosed a critical MLflow SSRF vulnerability in outbound webhook delivery caused by a DNS rebinding TOCTOU gap. The report described how an authenticated user could abuse webhook creation to reach cloud metadata and internal services, and proposed validating the connected peer IP at socket time.
MLflow maintainers fixed CVE-2026-64849 in version 3.15.0. The patch adds peer-socket verification and blocks non-global destination IPs before allowing webhook delivery.
Public reporting explained that MLflow validates webhook URLs but does not pin or re-validate the final destination, enabling SSRF through DNS rebinding and HTTP redirects. The issue can expose internal resources such as localhost services and cloud metadata endpoints, with reflected responses leaking retrieved data back to the attacker.
watchTowr Labs reported observing attackers target cloud-hosted MLflow systems within hours of CVE assignment. The exploitation attempts sought to extract credentials and other secrets from exposed deployments.
A critical unauthenticated SSRF vulnerability in MLflow webhook handling was identified as CVE-2026-64849. The flaw affects versions prior to 3.15.0 and can be abused to reach internal services and cloud metadata endpoints.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
16 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourcebleepingcomputer.com
Open sourcesecurityaffairs.com
Open sourcemalware.news
Open sourcecvereports.com
Open sourcecve.org
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**MLflow** disclosed and patched multiple high-severity vulnerabilities affecting deployments of the MLflow platform, including an **authentication bypass due to default credentials** in `basic_auth.ini` tracked as **CVE-2026-2635** (ZDI-26-111). The issue allows **unauthenticated remote attackers** to bypass authentication and potentially **execute arbitrary code with administrator context**; ZDI scored it **CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)** and credited the finding to **Peter Girnus (@gothburz)** via Trend Micro’s **Zero Day Initiative (ZDI)**. A separate MLflow Tracking Server flaw, **CVE-2026-2033**, enables **directory traversal leading to remote code execution** via improper validation of user-supplied artifact file paths in the artifact handler. Exploitation requires no authentication and can result in code execution in the context of the MLflow service account. Both issues reference the same upstream remediation in MLflow (`https://github.com/mlflow/mlflow/pull/19260`) and were published through ZDI advisories (including **ZDI-26-111** for CVE-2026-2635 and **ZDI-26-105** for CVE-2026-2033), indicating coordinated fixes are available and should be prioritized for exposed MLflow instances.
Jun 29, 2026
Threat actors are actively exploiting **CVE-2025-59528**, a **CVSS 10.0** remote code execution flaw in the open-source AI platform **Flowise**. The bug affects Flowise versions through **3.0.5** and stems from the `CustomMCP` node unsafely passing user-controlled input into JavaScript execution, allowing attackers with an API token to run arbitrary code with full **Node.js** runtime privileges. Researchers said the issue can be triggered remotely via a crafted HTTP `POST` request without user interaction, leading to operating system command execution, filesystem access, sensitive data theft, and full system compromise. Security researchers observed in-the-wild exploitation originating from a single **Starlink IP address**, while warning that roughly **12,000 to 15,000** internet-exposed Flowise instances sharply expand the attack surface for opportunistic attacks. Flowise disclosed the vulnerability in 2025, credited researcher **Kim SooHyun**, and patched the flaw in **version 3.0.6**. The incident marks the third Flowise vulnerability reported as exploited in the wild after **CVE-2025-8943** and **CVE-2025-26319**, increasing pressure on organizations to upgrade immediately and limit public exposure of Flowise APIs.
Jun 29, 2026
Threat actors rapidly exploited **CVE-2026-33017**, a critical unauthenticated remote code execution flaw in Langflow’s public flow build endpoint, allowing arbitrary Python code to reach an unsandboxed `exec()` path with a single crafted request. The bug affects Langflow versions prior to **1.9.0** and stems from the `POST /api/v1/build_public_tmp/{flow_id}/flow` endpoint accepting attacker-controlled flow data through an optional parameter. Researchers and vendor advisories said the issue is distinct from **CVE-2025-3248** because the vulnerable endpoint is intentionally public, meaning the fix required removing attacker-supplied flow data from that execution path rather than simply adding authentication. Sysdig and other researchers reported exploitation beginning within about **20 hours** of disclosure, with attackers scanning for exposed instances, validating code execution, reading files such as `.env`, `.db`, and `/etc/passwd`, stealing credentials, API keys, and database secrets, and attempting follow-on payload delivery from infrastructure including `173.212.205[.]251:8443`. The severity prompted **CISA** to add the flaw to its **Known Exploited Vulnerabilities** catalog and order federal agencies to remediate by **April 8, 2026** or discontinue use if they could not secure affected systems. Security guidance across the reports urged organizations to upgrade to **Langflow 1.9.0 or later**, restrict or remove internet exposure of the vulnerable endpoint, monitor outbound connections, and rotate secrets if compromise is suspected.
Jul 2, 2026