Full Report
Two critical vulnerabilities impacting MLflow, an open-source artificial intelligence (AI) platform, and FUXA, an open-source, web-based SCADA / HMI software built for operational technology (OT) and industrial automation, are witnessing malicious scanning and exploitation efforts. According to independent reports from watchTowr and VulnCheck, the vulnerabilities in question are as follows -
Analysis Summary
# Vulnerability: MLflow SSRF and FUXA Remote Code Execution
## CVE Details
- **CVE ID**: CVE-2026-64849 (MLflow) | CVE-2026-25895 (FUXA)
- **CVSS Score**: 9.3 (Critical) for MLflow | 9.5 (Critical) for FUXA
- **CWE**: SSRF (MLflow) | Missing Authentication / Path Traversal (FUXA)
## Affected Systems
- **Products**:
- MLflow (AI Platform)
- FUXA (SCADA/HMI Software)
- **Versions**:
- MLflow: Versions < 3.15.0
- FUXA: Versions <= 1.2.9
- **Configurations**: Systems exposed to the public internet are at high risk. MLflow instances with model-registry webhooks enabled are specifically targeted.
## Vulnerability Description
- **CVE-2026-64849 (MLflow)**: An unauthenticated Server-Side Request Forgery (SSRF) flaw resides in the model-registry webhooks. The vulnerability exists due to improper handling of web redirects, allowing attackers to bypass previous security fixes. Attackers can proxy requests through the MLflow server to reach internal cloud metadata endpoints.
- **CVE-2026-25895 (FUXA)**: A combination of missing authentication for critical functions and path traversal. This allows a remote attacker to write arbitrary files to the server’s file system.
## Exploitation
- **Status**: Exploited in the wild. Active malicious scanning by threat actors began within hours of CVE assignment.
- **Complexity**: Low
- **Attack Vector**: Network (Remote/Unauthenticated)
## Impact
- **Confidentiality**: High (Extraction of cloud credentials, secrets, and sensitive metadata).
- **Integrity**: High (Ability to overwrite system files like `main.js` in FUXA).
- **Availability**: High (Potential for Remote Code Execution (RCE) or system disruption via file overwrites).
## Remediation
### Patches
- **MLflow**: Update to version **3.15.0** or later.
- **FUXA**: Update to a version higher than **1.2.9**.
### Workarounds
- Restrict access to MLflow and FUXA interfaces using firewalls or VPNs to prevent public internet exposure.
- Disable model-registry webhooks in MLflow if not strictly required.
## Detection
- **Indicators of Compromise**:
- Requests attempting to overwrite `main.js` with junk data (FUXA).
- Unexpected outbound HTTP requests from the MLflow server to internal IP addresses (e.g., `169.254.169.254`).
- **Detection Methods**:
- Review MLflow audit logs for suspicious webhook activity.
- Monitor for unauthorized file modifications on the FUXA server file system.
- Check global honeypot telemetry for scanning activity originating from unknown IPs targeting the specific CVEs.
## References
- MLflow Security Advisory: hxxps://github[.]com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j
- FUXA Security Advisory: hxxps://github[.]com/frangoteam/FUXA/security/advisories/GHSA-88qh-cphv-996c
- WatchTowr Analysis: hxxps://www[.]linkedin[.]com/posts/watchtowr_mlflow-ssrf-cloudsecurity-activity-7230843654321
- VulnCheck Intelligence: hxxps://vulncheck[.]com/blog/fuxa-cve-2026-25895