CVE-2026-64849: MLflow SSRF Actively Exploited — Detection, Hunting, and Remediation Guide

---
title: MLflow Process Connecting to Cloud Instance Metadata Service
id: 9c4e2a71-3f8b-4d5a-b7c1-2e6f8a0d1b3c
status: experimental
description: Detects the MLflow server process (or its Python interpreter) initiating a network connection to cloud instance metadata endpoints, consistent with exploitation of CVE-2026-64849 SSRF to steal IAM credentials.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-64849
  - https://attack.mitre.org/techniques/T1552/005/
author: Security Arsenal
date: 2026/08/19
tags:
  - attack.credential_access
  - attack.t1552.005
  - cve.2026.64849
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|contains:
      - 'python'
      - 'mlflow'
      - 'gunicorn'
      - 'uvicorn'
    DestinationIp:
      - '169.254.169.254'
      - '100.100.100.200'
    DestinationHostname|contains:
      - 'metadata.google.internal'
      - 'metadata.azure.internal'
  condition: selection
falsepositives:
  - Legitimate cloud SDK calls from MLflow integrations refreshing credentials (validate process lineage and frequency)
level: critical
---
title: MLflow SSRF Attempt Against Internal Services via Tracking API
id: 5d1b8c34-7a2e-4f09-9c6d-8b3a1e5f2077
status: experimental
description: Detects inbound requests to an MLflow tracking server containing internal IP ranges, loopback, or link-local addresses embedded in request parameters, consistent with SSRF probing or exploitation of CVE-2026-64849.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-64849
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/08/19
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.64849
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-query|contains:
      - '169.254.169.254'
      - '169.254.170.2'
      - 'metadata.google.internal'
      - '127.0.0.1'
      - 'localhost'
      - '10.'
      - '172.16.'
      - '192.168.'
  selection_body:
    cs-body|contains:
      - '169.254.'
      - 'metadata.google.internal'
      - 'http://127.'
      - 'http://localhost'
      - 'file:///'
      - 'gopher://'
      - 'dict://'
  condition: 1 of selection_*
falsepositives:
  - Internal health checks referencing loopback (filter by source IP of load balancer)
  - Developers testing against internal artifact URIs
level: high
---
title: MLflow Server Process Making Unexpected Internal Network Connections
id: 2f7a9e15-6c4d-4b83-a1e9-0d5c3f8b62e4
status: experimental
description: Detects the MLflow server process initiating connections to RFC1918 or loopback destinations on ports atypical for artifact storage or database access, a hallmark of post-SSRF internal service access via CVE-2026-64849.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-64849
  - https://attack.mitre.org/techniques/T1046/
author: Security Arsenal
date: 2026/08/19
tags:
  - attack.discovery
  - attack.t1046
  - cve.2026.64849
logsource:
  category: network_connection
  product: linux
detection:
  selection_process:
    Image|contains:
      - 'mlflow'
      - 'gunicorn'
      - 'uvicorn'
  selection_internal:
    DestinationIp|startswith:
      - '10.'
      - '172.16.'
      - '192.168.'
      - '127.'
  filter_expected_ports:
    DestinationPort:
      - 443
      - 5432
      - 3306
  condition: selection_process and selection_internal and not filter_expected_ports
falsepositives:
  - Connections to internal model serving, feature store, or artifact proxy endpoints (tune DestinationPort filter to your architecture)
level: medium

// Hunt 1: MLflow/python processes reaching cloud metadata endpoints (IMDS credential theft via CVE-2026-64849)
let MetadataIPs = dynamic(["169.254.169.254", "100.100.100.200", "169.254.170.2"]);
union isfuzzy=true
(DeviceNetworkEvents
 | where TimeGenerated > ago(14d)
 | where InitiatingProcessFileName has_any ("python", "mlflow", "gunicorn", "uvicorn")
 | where RemoteIP in (MetadataIPs) or RemoteUrl has_any ("metadata.google.internal", "metadata.azure.internal")
 | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, RemoteUrl, InitiatingProcessAccountName),
(CommonSecurityLog
 | where TimeGenerated > ago(14d)
 | where DestinationIP in (MetadataIPs) or DestinationHostName has_any ("metadata.google.internal")
 | project TimeGenerated, DeviceName=DeviceHostName, InitiatingProcessFileName=ApplicationProtocol, InitiatingProcessCommandLine="", RemoteIP=DestinationIP, RemotePort=DestinationPort, RemoteUrl=DestinationHostName, InitiatingProcessAccountName=SourceUserName)
;

// Hunt 2: Inbound SSRF probes against the MLflow API in web/proxy logs
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where DeviceAction =~ "allowed" or isnull(DeviceAction)
| where DestinationPort == 5000 or RequestURL has "mlflow"
| where RequestURL has_any ("169.254.169.254", "metadata.google.internal", "127.0.0.1", "localhost", "file:///", "gopher://", "dict://")
   or AdditionalExtensions has_any ("169.254.", "metadata.google.internal")
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, RequestMethod, RequestURL, DeviceProduct
| order by TimeGenerated desc;

// Hunt 3: MLflow hosts with anomalous egress fan-out (internal pivot after SSRF)
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName has_any ("python", "mlflow", "gunicorn", "uvicorn")
| where RemoteIPType == "Private"
| summarize Destinations = dcount(RemoteIP), Ports = dcount(RemotePort), RemoteIPs = make_set(RemoteIP, 25) by DeviceName, InitiatingProcessCommandLine
| where Destinations > 10 or Ports > 8
| order by Destinations desc

-- Hunt: MLflow processes with connections to metadata services or unexpected internal destinations (CVE-2026-64849)
SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)mlflow|gunicorn|uvicorn'
   OR Exe =~ '(?i)python'

-- Correlate with live network state for metadata-service contact
SELECT Pid, Name, Status, Laddr, Raddr
FROM netstat()
WHERE Raddr =~ '169\\.254\\.169\\.254|169\\.254\\.170\\.2|100\\.100\\.100\\.200'
   AND Pid IN (SELECT Pid FROM pslist() WHERE CommandLine =~ '(?i)mlflow|gunicorn|uvicorn|python')

-- Inventory: which MLflow servers are listening on all interfaces (internet-exposure triage)
SELECT Pid, Name, Status, Laddr, Raddr
FROM netstat()
WHERE Status =~ 'LISTEN'
   AND Pid IN (SELECT Pid FROM pslist() WHERE CommandLine =~ '(?i)mlflow')
   AND Laddr =~ '^0\\.0\\.0\\.0|\\[::\\]'

#!/bin/bash
# CVE-2026-64849 - MLflow SSRF triage and compensating controls
# Run as root on MLflow hosts. Test in a non-production segment first.

echo "=== [1/5] Inventory running MLflow processes and versions ==="
ps aux | grep -iE 'mlflow|gunicorn|uvicorn' | grep -v grep || echo "No MLflow process found"
if command -v pip >/dev/null 2>&1; then
  pip show mlflow 2>/dev/null | grep -E 'Name|Version|Location' || echo "mlflow not installed via system pip"
fi
# Check virtualenvs and containers too
find /opt /srv /home -maxdepth 4 -name "activate" -path "*/bin/*" 2>/dev/null | while read -r venv; do
  echo "--- venv: $venv ---"
  "$(dirname "$venv")/pip" show mlflow 2>/dev/null | grep -E 'Name|Version'
done
docker ps --format '{{.Names}} {{.Image}}' 2>/dev/null | grep -i mlflow || echo "No MLflow containers detected"

echo "=== [2/5] Detect internet-exposed listeners (default port 5000) ==="
ss -tlnp | grep -E ':(5000)\b' | grep -E '0.0.0.0|\[::\]' && \
  echo "WARNING: MLflow listening on all interfaces - restrict immediately" || \
  echo "OK: No all-interface MLflow listener found"

echo "=== [3/5] COMPENSATING CONTROL: Block egress to instance metadata service ==="
# AWS/Azure IMDS + ECS task metadata endpoint
iptables -C OUTPUT -d 169.254.169.254 -p tcp --dport 80 -j REJECT 2>/dev/null || \
  iptables -A OUTPUT -d 169.254.169.254 -p tcp --dport 80 -j REJECT
iptables -C OUTPUT -d 169.254.170.2 -p tcp -j REJECT 2>/dev/null || \
  iptables -A OUTPUT -d 169.254.170.2 -p tcp -j REJECT
# Persist (Debian/Ubuntu); use firewalld equivalents on RHEL-family
iptables-save > /etc/iptables/rules.v4 2>/dev/null || iptables-save > /root/mlflow-egress-rules.v4
echo "Egress to 169.254.169.254 / 169.254.170.2 blocked."

echo "=== [4/5] Hunt for exploitation evidence in MLflow/HTTP access logs ==="
for logdir in /var/log/nginx /var/log/apache2 /var/log/mlflow /var/log; do
  [ -d "$logdir" ] || continue
  grep -rEi '169\.254\.169\.254|169\.254\.170\.2|metadata\.google\.internal|127\.0\.0\.1|file:///|gopher://|dict://' \
    "$logdir" --include='*.log' 2>/dev/null | head -50
done
echo "Review any hits above against BOD 26-04 Forensics Triage Requirements before remediating."

echo "=== [5/5] Validate: attempt metadata fetch (should fail) ==="
curl -s -m 3 http://169.254.169.254/latest/meta-data/ && \
  echo "FAIL: IMDS still reachable - verify iptables ordering / consider IMDSv2 enforcement" || \
  echo "PASS: IMDS unreachable from this host"

echo "=== DONE. Next: upgrade MLflow per vendor advisory, enforce authn, restrict egress. ==="