Attackers Actively Exploiting MLflow Vulnerability to Steal Cloud Credentials

The Hacker News reports that attackers are exploiting two critical vulnerabilities in MLflow, an open-source AI platform widely used for machine learning operations, and FUXA, an open-source SCADA and HMI software used in operational technology environments. The MLflow flaw, a server-side request forgery vulnerability, allows attackers to force the platform to make requests to internal cloud metadata services, enabling them to steal AWS, Azure or Google Cloud credentials and secrets stored in environment variables. Security researchers at watchTowr and VulnCheck have observed active scanning and exploitation attempts targeting exposed MLflow instances, with attackers using the flaw to pivot into cloud environments and exfiltrate sensitive data. The vulnerability affects default configurations and can be exploited without authentication in many deployments. The fact that exploitation is already underway means this is not a theoretical risk, and organisations should assume that any internet-facing or inadequately segmented MLflow deployment may already be targeted or compromised.

Why this matters for UK organisations

For UK organisations using MLflow or similar AI development platforms, this is a supply chain and configuration risk that requires immediate attention. MLflow is commonly deployed in data science and machine learning environments where it has access to cloud infrastructure, training data and model artefacts. If an instance is exposed to the internet or accessible from untrusted networks, attackers can leverage this flaw to gain a foothold in cloud environments, access credentials and move laterally into production systems. The vulnerability highlights a broader pattern where open-source development tools, often deployed rapidly to support innovation, are not always subject to the same security scrutiny as production systems. Many organisations may not have full visibility into where these tools are deployed, who is responsible for patching them or what access they have to sensitive resources. The risk is compounded by the fact that cloud metadata services, which provide credentials and configuration data to running instances, are often accessible by default and not always adequately restricted at the network or identity layer.

What to review

Review where MLflow and similar AI development tools are deployed, whether they are exposed to the internet and what access they have to cloud credentials or sensitive data. Ensure these platforms are patched, properly segmented and monitored for unusual activity, and consider whether cloud metadata services are adequately restricted at the network and identity layer. Organisations should also evaluate whether there is clear ownership of security for development and data science environments, whether these systems are included in vulnerability management and patching processes and whether there is visibility into what open-source tools are being deployed and how they are configured. Where MLflow or similar platforms are used, consider implementing network segmentation, restricting access to cloud metadata services using instance metadata service version 2 (IMDSv2) or equivalent controls and ensuring that credentials are rotated regularly and monitored for misuse.

Source: The Hacker News