{"id":2428,"date":"2026-08-18T20:34:55","date_gmt":"2026-08-18T20:34:55","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2428"},"modified":"2026-08-18T20:34:55","modified_gmt":"2026-08-18T20:34:55","slug":"attackers-exploit-mlflow-ssrf-flaw-to-steal-cloud-credentials-and-secrets","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2428","title":{"rendered":"Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets"},"content":{"rendered":"<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">Ravie Lakshmanan<\/span><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">Aug 18, 2026<\/span><\/span><span class=\"p-tags\">Vulnerability \/ Artificial Intelligence<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiOzcJe940Ayk9JrnE-tmotZ-mEHZiA5Jc0A8Sw9IZIfYEnH61X8whAW6jJZTnzLIQYA37foce9X_fshoAVwjLyBKrjvHbkuhhtwZ2Mewxtf1Syn9FBOvZBqwcMWXOCKFNnASyrCOQ9XTF6f174Aa4O55O7tbU6evYcrrV0H_psoYYq3uQQ_GvZqsu0e0ik\/s1700-e365\/mlflow.jpg\" style=\"display: block;  text-align: center; clear: left; float: left;\"><\/a><\/div>\n<p>Two critical vulnerabilities impacting MLflow, an open-source artificial intelligence (AI) platform, and FUXA, an open-source, web-based SCADA \/ HMI software built for operational technology (OT) and industrial automation, are witnessing malicious scanning and exploitation efforts.<\/p>\n<p>According to independent reports from watchTowr and VulnCheck, the vulnerabilities in question are as follows &#8211;<\/p>\n<ul>\n<li><strong><a href=\"https:\/\/github.com\/mlflow\/mlflow\/security\/advisories\/GHSA-7gwp-5pfp-969j\" target=\"_blank\">CVE-2026-64849<\/a><\/strong> (CVSS score: 9.3) &#8211; An unauthenticated Server-Side Request Forgery (SSRF) vulnerability in MLflow that can allow an attacker who can reach the Tracking Server (mlflow server) to issue HTTP requests to arbitrary internal cloud metadata endpoints and extract sensitive data. (Affects versions &lt; 3.15.0)<\/li>\n<li><strong><a href=\"https:\/\/github.com\/frangoteam\/FUXA\/security\/advisories\/GHSA-88qh-cphv-996c\" target=\"_blank\">CVE-2026-25895<\/a><\/strong> (CVSS score: 9.5) &#8211; A missing authentication for a critical function and path traversal vulnerability in FUXA that can allow an unauthenticated, remote attacker to write arbitrary files to the server file system and achieve remote code execution. (Affects versions &lt;= 1.2.9)<\/li>\n<\/ul>\n<p>\u00abAttackers are exploiting [CVE-2026-64849] to reach cloud metadata services directly, and exfiltrating cloud credentials and secrets,\u00bb watchTowr <a href=\"https:\/\/www.linkedin.com\/posts\/watchtowr_watchtowr-intel-is-observing-in-the-wild-activity-7495481580723838976-qzUA\/\" target=\"_blank\">said<\/a> in a post on LinkedIn, adding it detected bad actors indiscriminately scanning for exposed MLflow instances online within hours of the CVE being assigned on August 17, 2026.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/corelight-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjuvAqH13TTYyJD3aI-pJcYl54BoxQWMHc2aFwW2HbYUa5IKCjvHlzpzkFwXLTuV8aytky8kqLBgkoOtC8VQM5CGR0N5BXBl8RSXl-PYx_vIPbiLywiqXIvTPmm18cdEm_C0heVB-3U8zfG7K27RCAurtJ7OvxEyfQ0sVV_RRx1N4ZMWkqKgEBmkcDgjD6I\/s728-e100\/code-d.png\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>\u00abIt allows an attacker to exploit a flaw in MLflow&#8217;s model-registry webhooks to proxy requests through the affected system and interact with internal services,\u00bb Yordan Ganchev, principal threat intelligence specialist at watchTowr, said in a statement shared with The Hacker News.<\/p>\n<p>\u00abThe security bug bypasses prior fixes because of how it handles web redirects. Evidence from our global honeypot telemetry indicates attackers are abusing this vulnerability to target cloud-hosted MLflow systems in an attempt to extract credentials and secrets from well-known internal IP addresses and services.\u00bb<\/p>\n<p>Organizations running MLflow are recommended to prioritize patching affected, exposed systems, review audit logs for signs of compromise, and check whether sensitive credentials have been exposed.<\/p>\n<p>As for CVE-2026-25895, VulnCheck said it detected malicious scanning aimed at the flaw starting August 18, 2026. A single IP address has been observed broadly scanning the internet for vulnerable FUXA instances. There are about 60 FUXA installations exposed to the public internet.<\/p>\n<p>\u00abThe attacker request attempts to overwrite main.js with junk data via the CVE-2026-25895 path traversal,\u00bb Caitlin Condon, vice president of research at VulnCheck, <a href=\"https:\/\/www.linkedin.com\/posts\/ccondon_kev-vulnerability-rce-share-7495432850213670913-KseT\" target=\"_blank\">said<\/a> in a LinkedIn post. \u00abNo RCE payloads dropped yet.\u00bb<\/p>\n<p>Over the past year, two other vulnerabilities in FUXA \u2013 <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-25939\" target=\"_blank\">CVE-2026-25939<\/a> and <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-33831\" target=\"_blank\">CVE-2023-33831<\/a> \u2013 have also witnessed active exploitation efforts, with the latter witnessing activity \u00abdating back to November 2025 and as recently as yesterday,\u00bb per Condon.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>\ue804Ravie Lakshmanan\ue802Aug 18, 2026Vulnerability \/ Artificial Intelligence Two critical vulnerabilities impacting MLflow, an open-source artificial intelligence (AI) platform, and FUXA, an open-source, web-based SCADA \/ HMI software built for operational&hellip;<\/p>\n","protected":false},"author":1,"featured_media":2429,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[622,329,446,120,70,3068,145,3069,571],"class_list":["post-2428","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-attackers","tag-cloud","tag-credentials","tag-exploit","tag-flaw","tag-mlflow","tag-secrets","tag-ssrf","tag-steal"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2428","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2428"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2428\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/2429"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2428"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2428"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2428"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}