CISA KEV Addition: MLflow Server-Side Request Forgery (CVE-2026-64849)

Technical Analysis

CVE-2026-64849 is an SSRF vulnerability in MLflow, an open-source platform widely used for managing machine learning experiment tracking, model registries, and model deployment pipelines. SSRF flaws in MLflow servers typically allow an attacker to coerce the server into making unauthorized requests to internal network resources, cloud metadata endpoints (e.g., AWS/GCP/Azure instance metadata services), or internal APIs, potentially leading to credential theft, internal reconnaissance, or lateral movement. Because MLflow is commonly deployed as the backbone for tracking and serving models used by AI/ML pipelines and agentic systems, exploitation could expose cloud credentials, model artifacts, and API keys that feed into RAG pipelines and LLM agent tool-use frameworks, or allow attackers to tamper with tracked models and experiment metadata that agents rely on for decision-making. Organizations running AI agent infrastructure that integrate MLflow for model versioning or deployment should treat this as a direct supply-chain and credential-exposure risk to their agent stacks, not merely a standard web application vulnerability.

Affected Systems

MLflow Server instances (self-hosted and cloud-deployed) running vulnerable versions susceptible to SSRF via CVE-2026-64849; publicly exposed MLflow tracking servers and model registries are at highest risk.

Indicators of Compromise

• No specific IOCs (hashes, IPs, domains) published in this CISA alert; organizations should monitor MLflow server logs for anomalous outbound requests to internal IP ranges and cloud metadata endpoints (e.g., 169.254.169.254).

Remediation Steps

1. 1

   Patch MLflow

   Upgrade MLflow server installations to the vendor-released fixed version addressing CVE-2026-64849 as soon as possible.

2. 2

   Restrict Public Exposure

   Ensure MLflow tracking servers and registries are not directly exposed to the public internet; place them behind authentication, VPN, or network segmentation controls.

3. 3

   Block Metadata Endpoint Access

   Implement egress filtering or IMDSv2 enforcement to prevent SSRF requests from reaching cloud instance metadata services.

4. 4

   Compromise Assessment

   Per BOD 26-04 guidance, review logs to determine whether systems were compromised prior to patching, especially for internet-facing MLflow instances.

5. 5

   Audit Agent/ML Pipeline Credentials

   Rotate any API keys, cloud credentials, or secrets accessible to or stored within MLflow environments that also support AI agent or RAG pipeline operations.