Attackers actively exploit a critical server-side request forgery (SSRF) vulnerability in MLflow, the open-source machine learning platform, to steal cloud credentials and secrets from vulnerable deployments.

The flaw allows unauthenticated threat actors to bypass network boundaries and access internal cloud metadata services. By crafting malicious requests through MLflow's API, attackers retrieve AWS credentials, API tokens, and other sensitive authentication material stored in environment variables or cloud provider metadata endpoints.

MLflow powers data science and AI operations across organizations globally. The platform's web-based interface and REST API, if exposed or inadequately secured, become direct attack vectors. Researchers from watchTowr and VulnCheck documented active exploitation attempts in the wild, confirming attackers scan for vulnerable MLflow instances systematically.

The attack chain works straightforwardly. An attacker sends a specially crafted request to MLflow that forces the platform to make internal HTTP requests to cloud metadata services like AWS EC2's 169.254.169.254 endpoint. MLflow fetches the credentials without validation, returning them in response bodies or error messages. These stolen credentials grant attackers direct access to cloud storage, databases, and compute resources tied to the organization's AWS, Azure, or GCP accounts.

Organizations using MLflow require immediate patching. The vulnerability impacts MLflow's ability to validate and restrict outbound requests. Cloud credential exposure creates severe secondary risks. Attackers leverage stolen credentials to move laterally within cloud infrastructure, exfiltrate datasets, deploy malware, or establish persistent backdoors.

Simultaneously, a separate critical vulnerability in FUXA, web-based SCADA and HMI software for industrial operations, faces similar active exploitation. This compounds the risk landscape for organizations managing both AI infrastructure and operational technology systems.

Defense measures include updating MLflow to patched versions immediately, restricting MLflow instance access