Actively exploited vulnerabilities affecting MLflow products.https://wildfortech.comhttps://wildfortech.com/security#CVE-2026-64849https://wildfortech.com/security#CVE-2026-64849This Server-Side Request Forgery (SSRF) flaw in MLflow allows an attacker to make the MLflow server issue requests on their behalf to internal network resources or cloud metadata services — such as AWS IMDSv1 or similar endpoints. The attacker can then read the response status and body, potentially harvesting cloud credentials, internal service data, or other sensitive information that should never be externally accessible. Organizations running MLflow in cloud or hybrid environments face elevated risk.Wed, 19 Aug 2026 00:00:00 GMTMLflowMLflow