Actively Exploited MLflow Flaw Can Expose Cloud Credentials

Security officials have listed CVE-2026-64849, a vulnerability in the open-source MLflow platform, in the Known Exploited Vulnerabilities Catalog after evidence of active exploitation. The Cybersecurity and Infrastructure Security Agency added the flaw on 19 August 2026 and set 2 September 2026 as the remediation due date for covered federal systems. MLflow versions before 3.15.0 are affected.

The story matters because the weakness sits in adjacent AI infrastructure rather than in Drupal itself. An unauthenticated attacker who can reach a vulnerable MLflow tracking server can cause it to send requests to internal services, loopback addresses or cloud metadata endpoints and return data from those requests. For Drupal teams running separate AI services, a fully updated CMS therefore does not remove risk elsewhere in the stack.

The upstream MLflow security advisory describes the issue as a server-side request forgery vulnerability in model registry webhook delivery. The affected implementation validates the original webhook destination but can follow redirects and resolve subsequent destinations without applying equivalent protection. That behaviour can allow a request that begins with an approved public destination to reach internal or cloud metadata services.

MLflow fixed the issue in version 3.15.0. CISA's KEV listing establishes active exploitation, but the available government and upstream material does not identify victims, a specific campaign or a threat actor. The 2 September 2026 remediation deadline applies to covered US federal systems rather than to every organisation using MLflow.

For Drupal, the connection is architectural rather than direct. Drupal AI documents integrations with external AI providers and related services, but the available documentation does not identify MLflow as a dependency or standard component of the project. Organisations operating MLflow alongside Drupal should upgrade affected installations to version 3.15.0 or later, review network exposure, and assess the AI service independently of Drupal's own update status.