MLflow SSRF Flaw Exploited for Cloud Credential Theft

Threat actors are actively scanning for and exploiting two critical vulnerabilities in widely used open-source platforms, with one flaw already being leveraged to steal cloud credentials and secrets from exposed MLflow instances. The attacks highlight the persistent risk posed by unpatched AI and operational technology systems.

Critical Flaws in AI and OT Platforms

Independent reports from watchTowr and VulnCheck detail active exploitation of vulnerabilities in MLflow, an open-source AI platform, and FUXA, a web-based SCADA/HMI software for operational technology (OT) and industrial automation.

The two critical flaws are:

• CVE-2026-64849 (CVSS score: 9.3) — An unauthenticated Server-Side Request Forgery (SSRF) vulnerability in MLflow that allows an attacker who can reach the Tracking Server (mlflow server) to issue HTTP requests to arbitrary internal cloud metadata endpoints and extract sensitive data. Affects versions before 3.15.0.
• CVE-2026-25895 (CVSS score: 9.5) — A missing authentication for a critical function and path traversal vulnerability in FUXA that allows an unauthenticated, remote attacker to write arbitrary files to the server file system and achieve remote code execution. Affects versions up to and including 1.2.9.

Cloud Credentials Under Siege

According to watchTowr, attackers are exploiting CVE-2026-64849 to reach cloud metadata services directly and exfiltrate cloud credentials and secrets. The firm detected indiscriminate scanning for exposed MLflow instances online within hours of the CVE being assigned on August 17, 2026.

"It allows an attacker to exploit a flaw in MLflow's model-registry webhooks to proxy requests through the affected system and interact with internal services," Yordan Ganchev, principal threat intelligence specialist at watchTowr, said in a statement shared with The Hacker News.

— Yordan Ganchev, principal threat intelligence specialist at watchTowr

Ganchev added that the security bug bypasses prior fixes because of how MLflow handles web redirects. Evidence from watchTowr's global honeypot telemetry indicates attackers are abusing the vulnerability to target cloud-hosted MLflow systems, attempting to extract credentials and secrets from well-known internal IP addresses and services.

Organizations Urged to Patch MLflow

Organizations running MLflow are recommended to prioritize patching affected, exposed systems, review audit logs for signs of compromise, and check whether sensitive credentials have been exposed.

Given the criticality of the flaw and the demonstrated exploitation, immediate action is essential for any organization with MLflow deployments reachable from the internet.

FUXA Attacks Begin

VulnCheck detected malicious scanning aimed at CVE-2026-25895 starting August 18, 2026. A single IP address has been observed broadly scanning the internet for vulnerable FUXA instances. There are about 60 FUXA installations exposed to the public internet.

Caitlin Condon, vice president of research at VulnCheck, said in a LinkedIn post: "The attacker request attempts to overwrite main.js with junk data via the CVE-2026-25895 path traversal. No RCE payloads dropped yet."

Previous FUXA Exploitation

Over the past year, two other vulnerabilities in FUXA — CVE-2026-25939 and CVE-2023-33831 — have also witnessed active exploitation efforts. Condon noted that activity for CVE-2023-33831 dates back to November 2025 and has been observed as recently as yesterday.

The continued targeting of FUXA underscores the risk faced by OT environments, where unpatched systems can have severe operational consequences.

What This Means for Your Security

These events highlight the critical nature of patching known vulnerabilities in internet-facing systems, especially those involved in AI and industrial operations. The MLflow flaw specifically shows how SSRF vulnerabilities can be weaponized to steal cloud credentials, which could lead to data breaches and account takeovers.

For organizations using these platforms, the evidence of active exploitation suggests that unpatched systems are at immediate risk. Prioritizing patches, monitoring audit logs, and reviewing exposed credentials are prudent steps. The involvement of OT systems in these attacks also raises concerns about the security of industrial infrastructure.