CVE-2025-51481: dagster path traversal exposes

CISO Take

Dagster's gRPC server allows any client with network access to read arbitrary files by injecting path traversal sequences into notebook_path — including credentials, configs, and model artifacts stored on the orchestration host. Patch immediately to 1.10.16; the fix is available and straightforward. If you cannot patch now, restrict gRPC server access to trusted internal hosts via firewall rules.

What is the risk?

CVSS 6.6 Medium understates practical risk in ML/AI environments. Dagster orchestration hosts typically hold high-value assets: cloud provider credentials, database connection strings, API keys for model registries, and training data paths. The attack requires gRPC server access — not internet exposure — but in multi-tenant or shared ML infrastructure this access is often broadly granted. EPSS of 0.00031 indicates no observed exploitation yet, but the technique is trivial once access exists. Not in CISA KEV. Risk elevates to HIGH in environments where Dagster runs with broad filesystem access or where gRPC is accessible across team boundaries.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
dagster	pip	< 1.10.16	`1.10.16`

Do you use dagster? You're affected.

How severe is it?

CVSS 3.1

6.6 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 40% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Local

AC Low

PR None

UI Required

S Unchanged

C High

I Low

A Low

What should I do?

6 steps

PATCH

Upgrade dagster to >= 1.10.16 immediately — this is the only complete fix.
NETWORK

Restrict gRPC port access (default 4266) to known orchestration clients only via firewall/security group rules.
LEAST PRIVILEGE

Audit what the Dagster service account can read on the filesystem — restrict to only required directories.
SECRETS MANAGEMENT

Ensure credentials on Dagster hosts are stored in a secrets manager (Vault, AWS Secrets Manager) rather than flat files.
DETECTION

Monitor for gRPC ExternalNotebookData requests containing '..', '%2e', or absolute paths outside the notebook directory. Review Dagster access logs for unusual notebook_path values.
VERIFY

Check git history and access logs for any signs of pre-patch exploitation.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Extraction Data Leakage Framework Training Data AML.T0025 - Exfiltration via Cyber Means AML.T0035 - AI Artifact Collection AML.T0037 - Data from Local System AML.T0049 - Exploit Public-Facing Application AML.T0055 - Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

6.1.2 - AI risk assessment 8.4 - AI system lifecycle — operational security

NIST AI RMF

MANAGE-2.4 - Risk treatment and response MAP-1.5 - Organizational risk tolerance

OWASP LLM Top 10

LLM05 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2025-51481?

Dagster's gRPC server allows any client with network access to read arbitrary files by injecting path traversal sequences into notebook_path — including credentials, configs, and model artifacts stored on the orchestration host. Patch immediately to 1.10.16; the fix is available and straightforward. If you cannot patch now, restrict gRPC server access to trusted internal hosts via firewall rules.

Is CVE-2025-51481 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2025-51481, increasing the risk of exploitation.

How to fix CVE-2025-51481?

1. PATCH: Upgrade dagster to >= 1.10.16 immediately — this is the only complete fix. 2. NETWORK: Restrict gRPC port access (default 4266) to known orchestration clients only via firewall/security group rules. 3. LEAST PRIVILEGE: Audit what the Dagster service account can read on the filesystem — restrict to only required directories. 4. SECRETS MANAGEMENT: Ensure credentials on Dagster hosts are stored in a secrets manager (Vault, AWS Secrets Manager) rather than flat files. 5. DETECTION: Monitor for gRPC ExternalNotebookData requests containing '..', '%2e', or absolute paths outside the notebook directory. Review Dagster access logs for unusual notebook_path values. 6. VERIFY: Check git history and access logs for any signs of pre-patch exploitation.

What systems are affected by CVE-2025-51481?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, MLOps orchestration, feature engineering pipelines, model deployment automation.

What is the CVSS score for CVE-2025-51481?

CVE-2025-51481 has a CVSS v3.1 base score of 6.6 (MEDIUM). The EPSS exploitation probability is 0.52%.

What is the AI security impact?

Affected AI Architectures

training pipelinesMLOps orchestrationfeature engineering pipelinesmodel deployment automation

MITRE ATLAS Techniques

AML.T0025 Exfiltration via Cyber Means

AML.T0035 AI Artifact Collection

AML.T0037 Data from Local System

AML.T0049 Exploit Public-Facing Application

AML.T0055 Unsecured Credentials

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: 6.1.2, 8.4

NIST AI RMF: MANAGE-2.4, MAP-1.5

OWASP LLM Top 10: LLM05

What are the technical details?

Original Advisory

Local File Inclusion in dagster._grpc.impl.get_notebook_data in Dagster 1.10.14 allows attackers with access to the gRPC server to read arbitrary files by supplying path traversal sequences in the notebook_path field of ExternalNotebookData requests, bypassing the intended extension-based check.

Exploitation Scenario

An adversary with access to a Dagster gRPC endpoint — such as a compromised CI/CD runner, a malicious insider, or a misconfigured internal service — sends a crafted ExternalNotebookData gRPC request with notebook_path set to '../../../../etc/environment' or '../../../../home/dagster/.aws/credentials'. The extension check (intended to allow only .ipynb files) is bypassed via path traversal sequences. The gRPC server reads and returns the file contents. The attacker extracts cloud credentials, uses them to access S3 buckets containing training data or model artifacts, and pivots to compromise the broader ML infrastructure. The entire chain requires no authentication beyond gRPC server access.

Weaknesses (CWE)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Primary

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.