Exploiting MLflow SSRF Vulnerability: Emerging Attack Techniques

The recent exploitation of MLflow’s server-side request forgery (SSRF) vulnerability, documented as CVE-2026-64849, has captured attention in the security community. This attack vector allows threat actors to access internal resources or cloud metadata services, posing significant risks to organizations using MLflow for managing the machine learning lifecycle.

Campaign or TTP Overview

In late 2023, a surge of attacks exploiting the SSRF vulnerability in MLflow was observed, affecting a range of organizations primarily in the tech and financial sectors. These attacks were sophisticated in their execution, leveraging the vulnerability to gain unauthorized access to internal services. According to reports, these campaigns targeted environments where MLflow was deployed without necessary security hardening, exploiting the flaw to perform lateral moves within the network.

The use of this vulnerability allowed attackers to redirect MLflow’s internal HTTP requests to access otherwise restricted metadata endpoints, particularly in cloud environments. Affected organizations reported exfiltration attempts as attackers sought to retrieve sensitive data such as credentials, keys, and access tokens that could aid in further penetration or exploitation.

The MLflow SSRF vulnerability has become a focal point for advanced attackers seeking to escalate privileges and compromise sensitive cloud infrastructure.

How It Was Built

The attackers behind these campaigns orchestrated well-constructed assaults leveraging controlled infrastructure to launch SSRF attacks. Their operations typically started with reconnaissance to identify vulnerable MLflow instances. By exploiting the SSRF flaw, they were able to make MLflow servers execute unauthorized request paths.

The infrastructure setup was straightforward but effective. Attackers often used domains mimicking legitimate cloud service providers to trick the application into fetching metadata. The payload delivered through these requests contained scripts designed to parse and return sensitive data, efficiently exfiltrating it to attacker-controlled endpoints.


GET /api/2.0/mlflow/runs/get HTTP/1.1

Host: vulnerable.server

User-Agent: legitimateUserAgent

Accept: */*

GET_METADATA: true

TARGET: http://169.254.169.254/latest/meta-data/

Domains in these campaigns typically resembled real service provider URLs, such as:


aws-stats.myclouddata-secure[.]com

azure-metadata.check[.]net

These realistic domain patterns tricked automated security systems and even diligent human operators into believing the requests were legitimate.

Why It Worked

A key reason these campaigns succeeded was the realistic domain masquerading strategy. By mimicking legitimate cloud provider metadata URLs, attackers bypassed many defenses that rely on DNS filtering and domain reputation scoring.

The payload’s leverage of the MLflow SSRF vulnerability was also significant because it used MLflow’s own request permissions to execute internal calls, which made it difficult for security systems to distinguish malicious activities from legitimate operations.

Another effective aspect was the attackers’ strategic targeting of poorly defended MLflow deployments. They identified systems that lacked up-to-date security patches or configuration hardening, which allowed unrestricted server-side requests.

Operator Takeaways

For red teamers aiming to replicate or draw lessons from these techniques, emphasis should be on the detailed execution of phishing and SSRF approaches that play on social or technical trust mechanisms. Deploying accurate domain mimicry and consistently seeking out unpatched systems are direct lessons to be learned. Utilizing infrastructure that appears trustworthy and aligns closely with legitimate services will enhance believability and access.

Good / Better / Best

Good: Identify and exploit open SSRF endpoints with generic domains.
Better: Customize domains to fit the victim’s cloud environment, increasing credibility.
Best: Implement an adaptive phishing campaign that couples the SSRF attack with social engineering via direct communication highlighting “urgent updates” to their cloud services.