AI Threat Alert
CVE-2025-0453: MLflow: GraphQL DoS disables ML tracking server
GHSA-49m6-vrr9-2cqm HIGH PoC AVAILABLE CISA: TRACK*MLflow's GraphQL endpoint allows unauthenticated attackers to exhaust all server workers via batched query flooding, taking down your entire ML experiment tracking and model registry. If MLflow is accessible beyond your internal network perimeter, treat this as high priority. Immediately restrict network access to the /graphql endpoint and audit firewall rules for MLflow deployments.
Risk Assessment
CVSS 7.5 High with zero authentication required and low attack complexity makes this trivially exploitable by any network-adjacent attacker. EPSS is low (0.136%) suggesting no observed mass exploitation yet, but the exploit mechanism is simple enough that proof-of-concept code on huntr.com lowers the practical bar significantly. Enterprise risk depends entirely on exposure: internal-only MLflow deployments are lower risk, but MLflow instances exposed via shared cloud environments, Kubernetes ingress without auth proxy, or developer shortcuts are genuinely vulnerable. No patch is available as of publication date.
Affected Systems
Severity & Risk
Attack Surface
Recommended Action
6 steps-
IMMEDIATE
Restrict /graphql endpoint access at the network layer—MLflow should never be directly internet-exposed; enforce this via firewall rules or reverse proxy ACLs.
-
SHORT-TERM: Deploy an API gateway or WAF rule to rate-limit requests to /graphql per source IP.
-
WORKAROUND
If MLflow must be accessible, add an authenticated reverse proxy (nginx/Traefik with basic auth or SSO) in front of all MLflow endpoints.
-
DETECTION
Monitor for abnormal spikes in /graphql request volume or worker saturation in MLflow metrics; alert on CPU/thread exhaustion.
-
PATCH
No fixed version confirmed—monitor mlflow GitHub releases and huntr advisory for patch availability; upgrade immediately when released.
-
AUDIT
Inventory all MLflow instances across your environments, including shadow deployments by data science teams.
CISA SSVC Assessment
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
Classification
Compliance Impact
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2025-0453?
MLflow's GraphQL endpoint allows unauthenticated attackers to exhaust all server workers via batched query flooding, taking down your entire ML experiment tracking and model registry. If MLflow is accessible beyond your internal network perimeter, treat this as high priority. Immediately restrict network access to the /graphql endpoint and audit firewall rules for MLflow deployments.
Is CVE-2025-0453 actively exploited?
Proof-of-concept exploit code is publicly available for CVE-2025-0453, increasing the risk of exploitation.
How to fix CVE-2025-0453?
1. IMMEDIATE: Restrict /graphql endpoint access at the network layer—MLflow should never be directly internet-exposed; enforce this via firewall rules or reverse proxy ACLs. 2. SHORT-TERM: Deploy an API gateway or WAF rule to rate-limit requests to /graphql per source IP. 3. WORKAROUND: If MLflow must be accessible, add an authenticated reverse proxy (nginx/Traefik with basic auth or SSO) in front of all MLflow endpoints. 4. DETECTION: Monitor for abnormal spikes in /graphql request volume or worker saturation in MLflow metrics; alert on CPU/thread exhaustion. 5. PATCH: No fixed version confirmed—monitor mlflow GitHub releases and huntr advisory for patch availability; upgrade immediately when released. 6. AUDIT: Inventory all MLflow instances across your environments, including shadow deployments by data science teams.
What systems are affected by CVE-2025-0453?
This vulnerability affects the following AI/ML architecture patterns: ML experiment tracking, model registry, MLOps pipelines, training pipelines, CI/CD for ML.
What is the CVSS score for CVE-2025-0453?
CVE-2025-0453 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.32%.
Technical Details
NVD Description
In mlflow/mlflow version 2.17.2, the `/graphql` endpoint is vulnerable to a denial of service attack. An attacker can create large batches of queries that repeatedly request all runs from a given experiment. This can tie up all the workers allocated by MLFlow, rendering the application unable to respond to other requests. This vulnerability is due to uncontrolled resource consumption.
Exploitation Scenario
An attacker discovers an exposed MLflow tracking server (common in cloud environments with permissive security groups or Kubernetes LoadBalancer services). They send a burst of GraphQL batch queries to /api/2.0/graphql, each requesting all runs across large experiments. MLflow's worker pool—typically 4-8 Gunicorn workers—becomes fully occupied processing these expensive database queries. Within seconds, legitimate requests queue indefinitely and time out. The attacker sustains the attack with minimal bandwidth, maintaining a small continuous stream of batch queries. Data scientists cannot log new experiments or access the model registry; automated training pipelines fail; on-call engineers scramble to diagnose what appears to be an infrastructure issue rather than an attack.
Weaknesses (CWE)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References
Timeline
Related Vulnerabilities
CVE-2025-15379 10.0 MLflow: RCE via unsanitized model dependency specs
Same package: mlflow CVE-2023-3765 10.0 MLflow: path traversal allows arbitrary file read
Same package: mlflow CVE-2023-1177 9.8 MLflow: path traversal allows arbitrary file read/write
Same package: mlflow CVE-2026-2635 9.8 mlflow: security flaw enables exploitation
Same package: mlflow CVE-2023-2780 9.8 MLflow: path traversal allows arbitrary file read/write
Same package: mlflow