MLflow SSRF Lets Attackers Steal Cloud Credentials via Metadata Services
A server-side request forgery in MLflow before 3.15.0 allows unauthenticated access to internal endpoints including cloud metadata services, enabling cloud credential and IAM secret theft.
- Vendor
- MLflow
- Product
- MLflow (< 3.15.0)
- CVSS
- 9.3
- EPSS (exploit probability)
- N/A
- Status
- exploited-in-wild
- Published
An SSRF vulnerability in the MLflow experiment tracking platform — present in all versions before 3.15.0 — lets an attacker route HTTP requests through the MLflow server to internal network endpoints the attacker cannot reach directly. In cloud-hosted deployments, the primary target is the instance metadata service (IMDS). On AWS, a request to the IMDS endpoint returns the IAM role credentials attached to the hosting instance without additional authentication. Azure and GCP expose similar metadata endpoints under different paths.
watchTowr documented active exploitation of this vector as of August 2026, with attackers targeting cloud credential endpoints to extract secrets and pivot into connected cloud resources.
Affected versions: MLflow < 3.15.0
Fixed in: MLflow 3.15.0
What to do:
- Upgrade MLflow to 3.15.0 immediately.
- If an immediate upgrade is not operationally possible: restrict network access to the MLflow tracking server so it cannot initiate outbound connections to cloud metadata endpoints, and audit the IAM role attached to the hosting instance for least-privilege exposure.
References:
