MLflow SSRF Flaw Actively Exploited to Steal Cloud Credentials
A critical Server-Side Request Forgery (SSRF) vulnerability in MLflow's unauthenticated webhooks API allowed attackers to pivot through the ML platform to extract cloud credentials and secrets without any authentication required. The root failure is twofold: a sensitive API endpoint was left exposed without authentication controls, and organizations failed to apply patches before active exploitation began. This matters because MLflow instances are commonly deployed in cloud environments with broad IAM permissions, meaning credential theft can rapidly escalate to full cloud account compromise. CISA's addition of this CVE to the Known Exploited Vulnerabilities catalog signals that this is not a theoretical risk — real-world attacks are already underway.
Tactical Insight
Immediate actions
- Upgrade all MLflow instances to version 3.15.0 or later before the CISA-mandated two-week federal deadline.
- Restrict or firewall the model-registry webhooks API endpoint to trusted internal networks only until patching is complete.
- Rotate all cloud credentials and secrets accessible from affected MLflow instances as a precautionary measure.
Long-term improvements
- Enforce authentication and authorization on all MLflow API endpoints, including webhooks, as a baseline configuration standard.
- Maintain a continuously updated inventory of all ML/AI tooling deployed in cloud environments and include them in your vulnerability management program.
- Apply least-privilege IAM policies to MLflow service accounts to limit the blast radius of any future credential exposure.
Detection measures
- Monitor MLflow webhook API logs for anomalous outbound requests indicative of SSRF exploitation attempts.
- Configure cloud provider alerts (e.g., AWS CloudTrail, Azure Monitor) to flag unusual credential usage or metadata service access originating from MLflow hosts.
- Integrate CISA KEV catalog feeds into your vulnerability prioritization workflow to ensure critical CVEs trigger immediate response procedures.