MLflow SSRF Flaw Under Active Exploitation to Harvest Cloud Credentials

Security researchers at watchTowr and VulnCheck have independently reported active scanning and exploitation of a critical server-side request forgery (SSRF) vulnerability in MLflow, the open-source AI/ML platform used to track experiments and manage models. The same report notes a separate critical flaw in FUXA, an open-source web-based SCADA/HMI tool used in operational technology (OT) and industrial automation environments, is also seeing malicious scanning activity.

What Was Reported

According to the source reporting, attackers are exploiting the MLflow SSRF issue in the wild. Full technical details, including specific CVE identifiers and exploitation mechanics, were not included in the summary available at publication time — this note will be updated as more detail becomes available.

Why It Matters

MLflow is widely deployed in ML pipelines that often run with cloud IAM roles or service credentials attached (AWS, Azure, GCP). An SSRF vulnerability in a platform like this is particularly dangerous because it can be used to reach cloud metadata services (e.g., the instance metadata endpoint) and exfiltrate temporary credentials, secrets, or tokens — potentially giving attackers a foothold well beyond the MLflow instance itself. The concurrent targeting of FUXA is notable because SCADA/HMI exposure extends risk into OT environments, where compromise can have safety and availability implications, not just data confidentiality.

Who's Affected

• Organizations running self-hosted or internet-exposed MLflow tracking servers, especially in cloud environments with attached IAM roles
• Organizations running FUXA for OT/industrial automation monitoring

What Defenders Should Do Now

• Inventory internet-facing MLflow instances and confirm current patch status; restrict access to trusted networks or behind authentication/VPN where possible
• Review MLflow server logs for anomalous outbound requests, especially to internal IP ranges or cloud metadata IPs (e.g., 169.254.169.254)
• Enforce IMDSv2 (or equivalent) on cloud instances hosting MLflow to reduce the blast radius of SSRF-based metadata theft
• Audit and rotate any cloud credentials or secrets that may have been reachable from MLflow hosts
• Separately, inventory and restrict exposure of FUXA instances, and monitor for unusual scanning or access attempts against SCADA/HMI web interfaces
• Watch for unusual API calls or resource usage tied to credentials associated with MLflow hosts, which could indicate downstream cloud compromise

This is a developing story based on independent reporting from watchTowr and VulnCheck, and specifics such as affected version ranges and CVE identifiers were not detailed in the available summary. Defenders should treat this as early-stage intel and monitor for updates. Read the original coverage at The Hacker News.