aiqbench takeAI Safety

Threat actors are actively exploiting a critical unauthenticated SSRF flaw (CVE-2026-64849) in MLflow to harvest cloud credentials from internet-exposed instances. The vulnerability stems from the server following HTTP redirects without re-validating secondary addresses, bypassing existing URL allowlists that only check initial destinations. Immediate patching to version 3.15.0 or higher is essential for data engineering teams using this open-source platform to track experiments and deploy models.

Sources coveringCybersecurity News, LessWrong, Viakoo, InfoQ

What this isA model's reading of the article and related coverage, written for aiqbench. Not the publisher's words.

Critical MLflow SSRF Vulnerability Exploited by Hackers in the Wild

Cybersecurity NewsAugust 18, 20263 min read

Threat actors are actively exploiting a critical, unauthenticated server-side request forgery (SSRF) vulnerability in MLflow, the popular open-source platform widely used by data engineering and machine learning teams to track experiments, package code, and deploy models. Tracked as CVE-2026-64849 with a critical CVSS 3.1 score of 9.3, the flaw impacts all MLflow versions prior to […] The post Critical MLflow SSRF Vulnerability Exploited by Hackers in the Wild appeared first on Cyber Security News.

Excerpt shown under the publisher's RSS terms · 57 words · full text and figures are on the publisher's site

Read at Cybersecurity News ↗Ask about this article