Cyber Threat Brief — August 20 2026

1. MLflow Webhook SSRF Exploited for Cloud Credential Theft — CVE-2026-64849

TL;DR: CISA added CVE-2026-64849 (CVSS 9.3) to KEV on August 19. Unauthenticated SSRF in MLflow’s webhook test endpoint lets attackers redirect requests to cloud metadata services and exfiltrate IAM credentials — exploitation began within hours of CVE assignment.

What’s New:

• CISA KEV addition August 19; watchTowr honeypots detected mass scanning within hours of CVE assignment August 17
• Root cause: TOCTOU flaw — _validate_webhook_url() checks original URL at registration but delivery.py follows HTTP redirects without re-validating, allowing redirect to 169.254.169.254 or 127.0.0.1
• Unauthenticated POST to /api/2.0/mlflow/webhooks/{id}/test returns upstream response_status and response_body — full-read SSRF
• DNS rebinding also viable as alternative bypass path
• Fixed in MLflow 3.15.0 (address pinning at connection time); many default deployments run without authentication

Actionable Intel

Artifact	Type	ATT&CK	Log Source	Action
POST /api/2.0/mlflow/webhooks/*/test	Exploit endpoint	T1190	WAF/reverse proxy logs	Block unauthenticated access; alert on external source IPs
Outbound to 169.254.169.254 from MLflow host	SSRF indicator	T1552.005	VPC flow logs, cloud metadata logs	Alert — indicates cloud credential theft attempt
Outbound to 127.0.0.1 / RFC1918 from MLflow	SSRF indicator	T1046	Network flow, proxy logs	Alert on internal service access from MLflow containers
HTTP redirect chains in webhook delivery	Exploit technique	T1090	MLflow application logs	Hunt for 301/302 responses to internal IPs
Unexpected IAM credential usage from MLflow instance	Post-exploitation	T1078.004	CloudTrail / GCP Audit / Azure Activity	Alert on AssumeRole or metadata token use from ML infra

Detection

Source	Rule	Gap
Splunk ESCU	None	Need: WAF rule for unauthenticated POST to /api/2.0/mlflow/webhooks/*/test; CloudTrail correlation for metadata credential use from ML infrastructure
Elastic	None	Need: HTTP redirect-to-internal-IP detection for containerized ML workloads
Sigma	None	Need: Web application SSRF via redirect pattern; cloud metadata access from non-standard source

Sources: CISA KEV August 19 · The Hacker News · watchTowr X post · GitHub Advisory GHSA-7gwp-5pfp-969j

---

Status Updates

• CVE-2025-62593 (Ray AI Framework): CISA KEV federal deadline TODAY August 20. ShadowRay 2.0 cryptomining exploitation ongoing against NVIDIA GPU clusters. Patch to Ray 2.52.0. Original brief.
• CVE-2026-33824 (Windows IKE): CISA KEV federal deadline TOMORROW August 21. Unit 42 confirmed Chinese-speaking actor exploiting IKE VPN endpoints (UDP 500/4500) with reverse-shell callbacks. Patch via April 2026 Patch Tuesday. Original brief.
• CVE-2026-50656/69414 (ShieldBreak): Still UNPATCHED. ShieldBreak bypass PoC released August 12 by Chaotic Eclipse. Microsoft acknowledged CVE-2026-69414, no fix timeline. WDAC/AppLocker primary mitigation. Original brief.
• CVE-2026-55040 (SharePoint JWT Auth Bypass): CISA KEV addition August 18. Active exploitation ongoing since August 12 after Rapid7 PoC. ~8,500 on-prem instances internet-exposed. Original brief.
• CVE-2026-59310 (VMware vCenter): CISA KEV addition August 18. China-nexus APT — 361 victims across 47 countries. Babuk-derived ESXi ransomware. Reverse_ssh cron persistence. Original brief.
• CVE-2026-19478 (GitLab GraphQL): Exploitation began shortly after August 17 disclosure per watchTowr and SecurityWeek. Self-managed instances remain primary target. No new IOCs. Original brief.
• CVE-2026-68820 (Windows AFD WinSock): Lazarus FudModule v3.1 rootkit ongoing. CISA KEV deadline August 25. No new IOCs. Original brief.