Critical MLflow Flaw Lets Attackers Steal Cloud Credentials via Webhook Redirects
A critical server-side request forgery flaw in MLflow, tracked as CVE-2026-64849 with a 9.3 CVSS score, lets unauthenticated attackers abuse the platform’s webhook-testing endpoint to reach cloud metadata services and steal IAM credentials. Exploitation began within hours of disclosure, and patching alone won’t revoke keys already stolen.
Itagora tiene in archivio titolo e sommario per la ricerca interna. Il testo completo resta sulla fonte. Il link in uscita non invia referrer.