Session CRT-20260824 — 24 August 2026 · Morning Edition

This is real, not CVSS theater. Fact: Before MLflow 3.15.0, the unauthenticated webhook-test endpoint validates only the original URL. The delivery code can then follow an unvalidated 302 redirect or re-resolve an already validated hostname without pinning its public IP. That lets the MLflow server request loopback, internal, or link-local metadata endpoints and reflect the response body to the attacker. It is effectively a guard checking the address on the envelope, then ignoring where the courier is redirected.

Active exploitation is supported, but credential theft is less firmly demonstrated. CISA’s CVE record marks exploitation “active,” and reporting says the flaw entered KEV after WatchTowr observed indiscriminate scanning within hours of assignment. WatchTowr also reported credential and secret exfiltration, but the available evidence does not include victim-level cloud audit records proving those credentials were subsequently used. Metadata reachability is confirmed SSRF—not automatically credential theft.

Tonight’s decision is straightforward: any internet-reachable MLflow below 3.15.0 gets patched or isolated now. Treat suspicious webhook-test requests, attacker-controlled URLs, redirects, DNS answer changes, or MLflow-originated connections to internal/link-local addresses as attempted exploitation. Escalate to confirmed SSRF when outbound telemetry or returned status/body proves the internal request succeeded. Escalate to credential exposure only when the response contains credential material; call it account compromise when cloud audit logs show that key, role, or session being used—especially from an unfamiliar source, user agent, or for enumeration and persistence. Exposure alone is not compromise, but waiting until morning is gambling with a server-side read primitive.

The official advisory confirms an unauthenticated, response-readable SSRF caused by unvalidated redirects and DNS rebinding; Cyber Daily reports active exploitation. The blast radius is therefore the MLflow workload identity—not merely the vulnerable process. AWS exposure becomes critical if the request can retrieve EC2 metadata credentials, particularly where IMDSv1 remains usable; IMDSv2 may block the path unless the primitive can perform its token-and-header exchange. Azure managed identity, GCP service-account metadata, ECS/EKS task identities, and Kubernetes APIs are meaningful only if MLflow can satisfy their required path, token, and header controls. The available evidence does not establish that capability universally, so do not assume every metadata service is compromised.

If credentials were retrievable, assess everything that identity can access: MLflow artifact storage in S3, Azure Blob, or GCS; model/container registries; secret stores; databases; queues; serverless or compute deployment APIs; and any permitted cross-account role, role assignment, or service-account impersonation path. Internal HTTP services reachable from the workload are also exposed if they trust network location or lack authentication. A least-privileged identity with restricted egress produces a small radius; a shared training-platform identity with secret access, deployment rights, or cross-account trust turns this into a control-plane incident. “Serverless” still has credentials—you simply cannot patch the server.

After preserving MLflow, proxy, DNS, workload, and cloud audit logs, the minimum sequence is: (1) isolate ingress and metadata/internal-service egress; (2) patch to 3.15.0 or later and rebuild from a trusted image; (3) disable or detach the workload identity and invalidate existing sessions where supported; (4) rotate static keys, webhook secrets, database credentials, and downstream tokens accessible to that identity; (5) review the identity’s effective permissions and cross-account trusts; (6) hunt from the earliest suspected exploit through the credential-validity window. Search for new principals or keys, policy/trust changes, secret reads, storage-policy or artifact changes, new compute/functions/jobs, registry pushes, Kubernetes RBAC or workload creation, and suspicious MLflow webhooks. Patching alone does not remove persistence created with stolen credentials.

MLflow outranks other patch work when it is pre-3.15.0, externally reachable or reachable from an untrusted tenant, and attached to a workload identity capable of metadata retrieval or privileged adjacent access—especially given reported exploitation. Thirty-minute CISO decision: declare a potential cloud-identity compromise, authorize immediate isolation and identity invalidation while preserving evidence, and scope response by effective IAM permissions rather than by the MLflow host. If metadata access is demonstrably blocked, egress constrained, and the identity narrowly scoped, patch urgently but keep incident escalation conditional on logs.

These are three bounded incidents, but one systemic control pattern: excessive authority without independent verification. The Sandbox involved compromised bridge permissions and unbacked SAND minting on Base/BNB Smart Chain; Term Labs involved concentrated governance power authorizing vault transfers; Allbridge involved acceptance of a forged CCTP message combined with flash-loan liquidity. There is no evidence here of shared infrastructure, a common attacker, or direct financial contagion between protocols. The systemic risk is architectural—privileged minting, governance, and cross-chain verification remain weak points.

Loss reconciliation:

• The Sandbox: 14.9 billion unbacked SAND is headline token creation, not a realizable dollar loss. Reporting estimates roughly 14.75 million genuine SAND left the Ethereum bridge adapter and puts extractable loss near $665,000. The affected bridges were disabled; Upbit and Bithumb suspended SAND deposits and withdrawals. Keep Base/BNB bridging and affected liquidity pools closed until every mint, redemption, and reserve withdrawal reconciles.
• Term Labs: approximately 2,843 ETH plus 1.68 million USDC, subsequently swapped into about 1.68 million DAI, supports the reported $8.5 million realized loss. The attacker reportedly controlled four USDC strategy vaults and about 91% of the Ethereum Meta Vault; initial funding came through 2 ETH from Tornado Cash. Freeze governance execution, vault withdrawals, and delegate changes; trace the ETH and DAI and alert their next centralized-exchange counterparties. Recovery remains unknown.
• Allbridge: reported realized theft was approximately $190,000, not the notional liquidity touched by the flash loan. Pause the affected CCTP route, reject the forged-message path, trace the proceeds, and coordinate immediately with Circle and any receiving exchange before another bridge hop.

I would not use the $840 million–$1.3 billion H1 figure for capital allocation or control benchmarking without transaction-level methodology. The range must separate gross theft, net unrecovered loss, counterfeit token issuance, flash-loan notional volume, frozen or returned funds, and cross-source duplication. These cited incidents were reported in August 2026, so they should not inflate an H1 total. The immediate priority is the recoverable money: Term Labs’ ETH/DAI trail first, then Allbridge’s smaller but potentially freezeable proceeds; The Sandbox requires reserve reconciliation rather than valuation of billions of counterfeit SAND.

FACT: The source pack reports a four-day generator outage but provides no intrusion vector, malware, vulnerability, indicators, controller evidence, or formal attribution. UNKNOWN: whether cyber activity caused the trip—or whether Iran-linked actors accessed any operational system at all. Operators should not blindly shut down comparable units. Maintain safe generation where process conditions permit; suspend nonessential vendor remote access at Levels 3/3.5; require local approval for essential sessions; and monitor DCS, turbine-control, protection, and safety alarms. Any segmentation change must be tested so it does not interrupt Level 1 control or safety communications.

Preserve evidence before resets or restoration: remote-access and authentication logs, firewall/VPN records, packet captures, engineering-workstation images, controller project/configuration copies, historian trends, HMI alarms, sequence-of-events and protection-relay records, maintenance notes, and synchronized clock information. Record the physical plant state and independently inspect fuel, mechanical, electrical-protection, and grid-interface causes.

Call it cyber-caused only when the access timeline correlates with accepted control commands or configuration changes and the physical trip sequence, while credible non-cyber causes are excluded. Call it Iran-linked only with corroborating infrastructure, tooling, operator behavior, or intelligence—not an Iranian IP address or unsupported media attribution.

My operational threshold for escalation tonight is credible suspected cyber activity combined with generation loss, attempted Level 1 manipulation, safety-system involvement, persistent unauthorized access, shared vendor-access exposure, similar activity at another plant, or potential grid impact. Notify the operator’s government and sector contacts and NCSC without waiting for attribution; the available evidence does not establish a specific statutory notification deadline.