Critical MLflow Flaw Being Exploited to Steal Cloud Credentials

A critical-severity vulnerability in MLflow, a widely used open-source platform for managing machine learning projects, is being actively exploited by attackers. The flaw allows malicious actors to send crafted HTTP requests to internal endpoints, tricking the system into revealing sensitive information such as cloud access credentials.

Once attackers obtain these credentials, they can potentially gain broader access to an organisation's cloud infrastructure, opening the door to data theft, service disruption, or further compromise of connected systems. Because MLflow is often deployed internally to support data science and AI teams, it may not receive the same security scrutiny as customer-facing applications, making this an attractive target for attackers.

Australian businesses increasingly rely on cloud-based tools and AI platforms to run their operations, and this incident is a reminder that internal tools carrying cloud credentials need the same level of protection as any other critical system. Organisations using MLflow should check for available patches or mitigations and review access controls immediately.