Attacks on MLflow: SSRF Vulnerability Exploited to Steal Cloud Secrets

Researchers at watchTowr and VulnCheck have independently observed active scanning and exploitation attempts targeting two critical vulnerabilities in popular open-source projects — the machine learning platform MLflow and the SCADA/HMI web system known as FUXA, used in industrial automation.

SSRF in MLflow

The biggest concern is CVE-2026-64849 (CVSS 9.3) — a Server-Side Request Forgery vulnerability that requires no authentication. It affects versions of MLflow below 3.15.0 and allows an attacker with access to the tracking server (mlflow server) to force the system to send HTTP requests to internal endpoints, including cloud metadata services.

According to watchTowr specialist Yordan Ganchev, the flaw lies in the model registry's webhooks mechanism: through it, requests are proxied across the vulnerable system to internal services. The vulnerability bypasses earlier fixes because of the way web redirects are handled. Data from a global network of honeypots shows that attackers are extracting credentials and secrets from well-known internal IP addresses.

The speed of the attackers' response is notable: mass, indiscriminate scanning of exposed MLflow instances began just hours after the CVE was assigned on August 17, 2026. Organizations are advised to prioritize patching externally accessible systems, review audit logs for signs of compromise, and determine whether any sensitive credentials have leaked.

File Writes in FUXA

The second issue is CVE-2026-25895 (CVSS 9.5) in FUXA versions up to and including 1.2.9. Here a missing authentication check on a critical function combines with directory traversal (path traversal), giving a remote, unauthenticated attacker the ability to write arbitrary files to the server and ultimately achieve code execution.

VulnCheck observed malicious scanning starting August 18, 2026: a single IP address is sweeping the internet in search of vulnerable installations. Fortunately, the attack surface is small — there are around 60 publicly exposed FUXA instances. So far, according to VP of research Caitlin Condon, only attempts to overwrite the main.js file with junk data have been seen; no full-fledged RCE payloads have been spotted yet.

It is worth noting that FUXA has drawn attention before: two other vulnerabilities, CVE-2026-25939 and CVE-2023-33831, have also been actively exploited, with attempts to use the latter stretching back to November 2025.

Source: The Hacker News