VulnerabilityBleeping Computer
9.3 — CRITICAL
CISA warns of hackers exploiting critical MLflow vulnerability
The Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies that threat actors are now exploiting a critical vulnerability in the MLflow open-source AI engineering platform. [...]
🤖 AI BriefingAuto-generated threat analysis
🔍Threat Overview
Threat actors are exploiting a critical MLflow vulnerability (CVE-2026-64849) that allows unauthenticated access to internal services and cloud metadata configurations, posing significant risks to federal agencies and organizations using the platform.
⚙️Technical Details
💥Impact Assessment
Severity: Critical
Who Is at Risk
Federal agencies and organizations using MLflow, particularly those with publicly exposed instances
🛡️Recommended Actions
1Patch MLflow to version 3.15.0 or higher as soon as possible
2Implement authentication for MLflow Tracking Server (mlflow server)
3Monitor internal services and cloud metadata configurations for suspicious activity
📦Affected Products
Lfprojects Mlflow
🔐NVD Verified DataVERIFIED
CVE-2026-64849 ↗CVSS 9.3 — CRITICAL
Attack Vector
NETWORK
Complexity
LOW
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:NWeaknesses
CWE-918
Affected Products (CPE)
Lfprojects Mlflow
Read the full article
This is a curated summary. The complete article is available at Bleeping Computer.