CISA Sets Sept. 2 Deadline to Patch MLflow, the Open-Source AI Model-Management Tool

CISA added an unauthenticated server-side request forgery in MLflow, the open-source platform companies use to manage and test machine-learning models, to its Known Exploited Vulnerabilities catalog this week, setting a Sept. 2 remediation deadline for federal agencies after WatchTowr honeypot operators reported internet-wide scanning for exposed instances within hours of disclosure.

The bug, tracked as CVE-2026-64849, sits in MLflow's webhook test. On a default install, the server follows a redirect to an attacker-chosen destination and returns whatever that endpoint sends back, without checking who is asking. MLflow maintainers reproduced the flaw in 3.13.0 against a local service. The cloud-credential reach comes from CISA's active-exploitation call and WatchTowr's scanning telemetry, not a confirmed public-cloud breach.

An MLflow host typically sits inside the same trust boundary as the cloud's instance metadata service, the internal endpoint that hands out short-lived IAM and STS credentials. A built-in test that follows a redirect into that boundary turns a default install into an unauthenticated credential-theft path.

The fix shipped in PR #24258 and release v3.15.0 the same week. WatchTowr's honeypot operators began seeing broad scanning for the webhook test endpoint within hours of the CVE assignment.