The Cybersecurity and Infrastructure Security Agency (CISA) has officially added CVE-2026-64849 to its Known Exploited Vulnerabilities catalog. The vulnerability affects MLflow, the ubiquitous open-source platform managed by the Linux Foundation and Databricks for managing the complete machine learning lifecycle, including experiment tracking, model packaging, and centralized model registries.

Rated with a maximum-severity CVSS v3.1 score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the vulnerability enables unauthenticated or low-privileged remote attackers to weaponize the MLflow tracking server into an internal proxy, issuing arbitrary network requests to cloud infrastructure endpoints and exfiltrating sensitive cloud instance metadata.

Technical Mechanics: Unvalidated Model Artifact URI Scheme Handling

The flaw stems from how the MLflow tracking server ingests and logs artifact locations during model version registration and run evaluations:

  • Arbitrary URI Ingestion: When users log model runs or register new candidate model artifacts via REST API endpoints (such as /ajax-api/2.0/mlflow/runs/create or /api/2.0/mlflow/artifacts/list), the server accepts arbitrary user-supplied artifact location URIs without enforcing an allowlist of permitted schemes.
  • Server-Side Request Trigger: When the tracking server attempts to inspect or download the specified artifact metadata, it issues an outbound HTTP request directly from the server host.
  • Cloud Metadata Exfiltration: By specifying link-local metadata IP addresses (such as http://169.254.169.254/latest/meta-data/iam/security-credentials/ on AWS or http://metadata.google.internal/computeMetadata/v1/ on GCP), an adversary extracts temporary administrative cloud tokens returned in the HTTP response body.

AI infrastructure clusters typically operate with high-privilege cloud IAM roles to read training datasets from S3 buckets and provision multi-GPU compute instances. An SSRF flaw in an ML tracking server allows threat actors to inherit these cloud privileges and compromise entire enterprise cloud tenants.

Affected MLflow Releases & Upgrades

MLflow Package / Edition Affected Release Versions Remediated Release Remediation Status
MLflow Open Source (PyPI) Versions prior to 2.15.1 MLflow 2.15.1 or later Emergency Directive Action Required
Databricks Managed MLflow Cloud Runtime Environments Automated Platform Patch Platform Safeguards Active
Self-Hosted Kubernetes Helm Deployments Chart versions using MLflow < 2.15.1 Update Container Image Tag Immediate Redeployment Mandated

DevSecOps Audit & Cloud Hardening Playbook

Platform engineers and MLOps teams must execute the following remediation protocol across MLflow host environments:

# Audit installed MLflow package version in Python environment
pip show mlflow | grep -E "Name|Version"

# Inspect MLflow server access logs for metadata IP address queries
grep -E "169.254.169.254|metadata.google" /var/log/mlflow/mlflow.log

# Enforce AWS IMDSv2 to require session tokens for metadata queries
aws ec2 modify-instance-metadata-options     --instance-id i-0123456789abcdef0     --http-tokens required     --http-endpoint enabled

Recommended AI Security Safeguards

  • Upgrade MLflow Instantly: Upgrade self-hosted MLflow tracking servers to version 2.15.1 or higher via pip (pip install --upgrade mlflow), which strictly validates artifact schemes and blocks SSRF redirect loops.
  • Enforce IMDSv2: Mandate AWS Instance Metadata Service Version 2 (IMDSv2) across all cloud compute nodes, ensuring SSRF requests lacking X-aws-ec2-metadata-token headers are rejected by the hypervisor.
  • Network Egress Filtering: Place MLflow tracking servers within private subnets with strict egress security group rules preventing direct connections to internal cloud metadata endpoints or private peer VPCs.