cybercrime.clubhttps://cybercrime.club/tags/mlops/Infrastructure security news for people who build infrastructure.Hugo -- gohugo.ioen-usThu, 20 Aug 2026 12:39:12 -0400Unauthenticated MLflow Webhook SSRF (CVE-2026-64849) Exploited Within Hours to Steal Cloud Credentialshttps://cybercrime.club/posts/mlflow-cve-2026-64849-webhook-ssrf-cloud-credential-theft/Thu, 20 Aug 2026 12:39:12 -0400https://cybercrime.club/posts/mlflow-cve-2026-64849-webhook-ssrf-cloud-credential-theft/An unauthenticated SSRF in MLflow's webhook-test endpoint, CVE-2026-64849, lets attackers bypass an existing SSRF guard via HTTP redirects to reach cloud metadata services — and exploitation began within hours of the CVE going public.vulnerabilities