MLflow SSRF Vulnerability Actively Exploited to Steal Cloud Credentials and Secrets

Security researchers have issued a warning that attackers are actively exploiting a vulnerability in MLflow, a widely used open-source platform for managing machine learning projects, to steal cloud credentials and secrets from organizations. The flaw is a type of web security weakness known as Server-Side Request Forgery (SSRF), which lets an attacker trick a vulnerable server into making requests to internal services that should not be reachable from the outside. In cloud environments, this often means the attacker can force the server to fetch temporary access keys that cloud providers store at a special internal network address. Those keys can then be used to control cloud resources such as storage buckets, databases, and virtual machines.

MLflow is a tool that data scientists and developers use to track experiments, store trained models, and deploy machine learning applications. It is often installed on servers inside a company's network or directly in a cloud account. Because MLflow deployments sometimes lack authentication or are left exposed to the public internet for convenience, they have become a favorite target for automated attacks. Once an attacker finds an exposed MLflow instance, they can test whether it is vulnerable to this SSRF flaw.

The SSRF weakness works like this: a server normally makes requests to external web addresses only when its own code asks it to, but if an attacker can supply a specially crafted URL that the server then fetches, the server can be tricked into contacting internal-only endpoints. On major cloud platforms, there is a well-known internal metadata service address (often 169.254.169.254) that returns temporary security credentials for the cloud account. If an MLflow server can be made to call that address, the attacker receives those credentials and can use them outside the server. This attack chain has been observed in many real-world incidents involving other tools, and now it is being used against MLflow.

The stolen cloud credentials can give attackers broad access: they can read sensitive data stored in cloud databases, copy files from cloud storage, launch expensive computing resources for cryptocurrency mining, or even modify website files hosted in the same cloud account. For website owners and IT teams, the risk extends beyond the machine learning tool itself; a single compromised internal service can become a foothold for a larger breach. Even organizations that do not directly use MLflow should check whether any third-party or internal system depends on it or on similar tools that may be exposed.

To reduce the risk, security professionals recommend several immediate steps. First, ensure that MLflow or any similar tool is not reachable from the public internet without a strong password or other authentication. If the tool must be reachable, place it behind a VPN or a network firewall so that only authorized users can access it. Second, apply any available updates or patches for MLflow as soon as they are released. Third, in cloud environments, enable protections such as IMDSv2 (Instance Metadata Service version 2), which blocks the older, simpler request method that SSRF attacks usually rely on. Finally, if there is any chance that credentials were exposed, rotate all cloud access keys and passwords for the affected account, and monitor access logs for unusual activity.

For many organizations, securing machine learning infrastructure is outside the core skill set of their web hosting or IT team. Security-first consulting and infrastructure services, such as those offered by AEU-I, can help audit cloud and self-hosted tools like MLflow, identify misconfigurations, and put controls in place before attackers strike. By treating these tools as part of the overall website and application security perimeter, companies can close the gap that attackers are now exploiting.