Honeypots catch exploitation attempts against an MLflow file-read flaw within a day of disclosure
Daily CyberSecurity reports Previdian's honeypots captured exploitation attempts against CVE-2026-116690, an unauthenticated arbitrary file read in the MLflow machine-learning platform, within a day of its October 27 disclosure. A second flaw fixed in the same release, CVE-2026-116692 (CVSS 9.8, unauthenticated remote code execution), has a public proof-of-concept but no reported in-the-wild attacks; MLflow 3.17.0 fixes both.
Attackers exploit a critical SSRF flaw in the MLflow AI platform to steal cloud credentials
watchTowr Labs reported that attackers are actively exploiting CVE-2026-64849, an unauthenticated server-side request forgery flaw in MLflow — an open-source platform for tracking ML models, LLMs and AI agents — to reach internal and cloud-metadata endpoints and extract credentials and secrets. The flaw, rated CVSS 9.3 and fixed in MLflow 3.15.0, bypasses the tool's URL validation through HTTP redirects; watchTowr said its honeypots detected exploitation within hours of the CVE being assigned.