MLflow SSRF Exploitation Leading to Cloud Credential Theft

Technical Analysis

The MLflow vulnerability allows attackers to abuse SSRF capabilities within model tracking or artifact-loading functionality to reach internal cloud metadata endpoints (e.g., AWS IMDS, GCP metadata server), enabling theft of IAM credentials, API keys, and other secrets tied to the underlying cloud environment. Exploitation appears to be opportunistic and scanner-driven, consistent with mass internet scanning for unpatched or misconfigured MLflow tracking servers exposed to the internet. FUXA's flaw is being tracked separately and affects OT/ICS environments, indicating parallel exploitation campaigns across two very different software ecosystems. Because MLflow is widely used to track, register, and serve models consumed by AI agent pipelines and MLOps workflows, successful SSRF exploitation can expose cloud credentials that agentic systems rely on for tool access, storage, and inference APIs, creating a direct downstream risk of credential-based compromise of connected AI agent infrastructure.

Affected Systems

Self-hosted MLflow tracking servers exposed to untrusted networks (version details pending confirmation from vendor advisory); FUXA SCADA/HMI open-source deployments exposed to the internet or improperly segmented OT networks.

Indicators of Compromise

• No specific hashes, IPs, or domains published at time of reporting; monitor watchTowr and VulnCheck advisories for updated IOC feeds.

Remediation Steps

1. 1

   Patch or Upgrade MLflow

   Apply the latest MLflow security patch addressing the SSRF vulnerability as soon as it is released; track official MLflow security advisories.

2. 2

   Restrict Network Exposure

   Ensure MLflow tracking servers and FUXA instances are not directly exposed to the public internet; enforce network segmentation and firewall rules limiting access to trusted internal hosts only.

3. 3

   Harden Cloud Metadata Access

   Enforce IMDSv2 (AWS) or equivalent metadata service protections on cloud instances hosting MLflow to prevent SSRF-based credential theft.

4. 4

   Rotate Exposed Credentials

   Rotate any cloud IAM credentials, API keys, or secrets that may have been accessible to a vulnerable MLflow instance.

5. 5

   Audit Agent and MLOps Pipeline Access

   Review which AI agents, automation pipelines, or CI/CD systems consume credentials or artifacts from MLflow and validate they have not been compromised.

6. 6

   Monitor for Scanning Activity

   Deploy detection for anomalous outbound requests from MLflow servers to internal metadata IP ranges (e.g., 169.254.169.254) and unusual authentication attempts.