CISA has warned that attackers are exploiting a critical vulnerability in MLflow, the open-source AI engineering platform used to debug, evaluate, optimize and monitor large language model and agent applications, according to BleepingComputer. The flaw is tracked as CVE-2026-64849. BleepingComputer, citing MLflow’s security advisory, describes it as a DNS-rebinding server-side request forgery bypass in MLflow’s outbound webhook delivery. MLflow patched the issue in version 3.15.0. The vulnerable surface is the MLflow Tracking Server in a default configuration described by MLflow’s security team: no authentication and a default SQLite backend. In that setup, the model-registry webhooks application programming interface can be reached without authentication, including a test endpoint that can return upstream response details to the caller, according to the report. That matters because an unauthenticated attacker who can reach an unpatched tracking server can cause the server to make HTTP requests to internal, loopback or cloud-metadata endpoints, BleepingComputer reports. The attacker can then read responses through the test path, creating a route to internal-only services, cloud instance metadata and host or port scanning behind a network boundary. BleepingComputer says successful exploitation could allow attackers to steal cloud credentials, including AWS Identity and Access Management credentials, in low-complexity attacks. The report does not provide details on the observed campaigns, affected victims or the scale of exploitation. CISA added CVE-2026-64849 to its catalog of known exploited vulnerabilities on Wednesday, according to BleepingComputer. The agency ordered U.S. Federal Civilian Executive Branch agencies to secure affected MLflow instances within two weeks under Binding Operational Directive 26-04. The directive applies to federal civilian agencies, but CISA urged all network defenders to prioritize remediation, BleepingComputer reports. The practical action is narrow: identify exposed MLflow deployments, determine whether they are running a vulnerable version, and update to the patched release where applicable. MLflow’s reach makes the advisory relevant beyond government systems. BleepingComputer describes MLflow as a Linux Foundation-backed project with more than 30 million monthly downloads and use across thousands of organizations, meaning the exposed population could include AI teams that stood up tracking servers for experimentation and left them reachable without stronger access controls. Who benefits: Security teams benefit from a concrete CVE, patch version and CISA prioritization signal. Attackers benefit where organizations left default, unauthenticated MLflow Tracking Server instances exposed. Who's exposed: The exposed group is organizations running reachable, unpatched MLflow instances affected by CVE-2026-64849. The risk is sharper for deployments matching the default tracking-server configuration described in the MLflow advisory.