Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials

Two critical vulnerabilities in MLflow and FUXA are under active exploitation, with attackers leveraging the flaws to steal cloud credentials and pursue remote code execution on exposed servers. Security researchers at watchTowr and VulnCheck have independently confirmed malicious scanning activity targeting both open-source platforms within days of public disclosure, underscoring the speed at which threat actors operationalize new attack vectors.

CVE-2026-64849, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in MLflow with a CVSS score of 9.3, allows attackers who can reach the Tracking Server to issue HTTP requests to arbitrary internal cloud metadata endpoints and extract sensitive data. The flaw affects MLflow versions prior to 3.15.0 and bypasses prior fixes by exploiting how MLflow's model-registry webhooks handle web redirects. According to watchTowr, attackers began indiscriminately scanning for exposed MLflow instances within hours of the CVE being assigned on August 17, 2026. "Attackers are exploiting [CVE-2026-64849] to reach cloud metadata services directly, and exfiltrating cloud credentials and secrets," watchTowr stated. Yordan Ganchev, principal threat intelligence specialist at watchTowr, told The Hacker News that the security bug enables attackers to proxy requests through affected systems and interact with internal services, with global honeypot telemetry confirming attempts to extract credentials from well-known internal IP addresses and cloud services.

Meanwhile, CVE-2026-25895, a missing authentication for critical function and path traversal vulnerability in FUXA with a CVSS score of 9.5, enables unauthenticated remote attackers to write arbitrary files to the server file system and achieve remote code execution. The flaw affects FUXA versions 1.2.9 and earlier. VulnCheck detected malicious scanning activity beginning August 18, 2026, with a single IP address broadly scanning the internet for vulnerable FUXA installations—approximately 60 of which remain exposed to the public internet. "The attacker request attempts to overwrite main.js with junk data via the CVE-2026-25895 path traversal," noted Caitlin Condon, vice president of research at VulnCheck, adding that no RCE payloads have been dropped yet. Over the past year, two other FUXA vulnerabilities—CVE-2026-25939 and CVE-2023-33831—have also seen active exploitation, with the latter showing activity dating back to November 2025.

Organizations running MLflow or FUXA should prioritize patching exposed systems immediately and conduct a thorough review of audit logs for indicators of compromise. Administrators should verify whether sensitive cloud credentials have been exposed and confirm that internal metadata services are not reachable from external-facing instances. Defenders can use a port scanner to identify exposed MLflow or FUXA endpoints across their networks and a SSL/TLS checker to validate proper encryption on related interfaces. Teams concerned about potential credential exposure should also run an email breach checker to determine whether compromised accounts have surfaced in known data leaks.