CVE-2025-51481 — MEDIUM (CVSS 6.6) AI Security Vulnerability

CISO Take

Dagster's gRPC server allows any client with network access to read arbitrary files by injecting path traversal sequences into notebook_path — including credentials, configs, and model artifacts stored on the orchestration host. Patch immediately to 1.10.16; the fix is available and straightforward. If you cannot patch now, restrict gRPC server access to trusted internal hosts via firewall rules.

Risk Assessment

CVSS 6.6 Medium understates practical risk in ML/AI environments. Dagster orchestration hosts typically hold high-value assets: cloud provider credentials, database connection strings, API keys for model registries, and training data paths. The attack requires gRPC server access — not internet exposure — but in multi-tenant or shared ML infrastructure this access is often broadly granted. EPSS of 0.00031 indicates no observed exploitation yet, but the technique is trivial once access exists. Not in CISA KEV. Risk elevates to HIGH in environments where Dagster runs with broad filesystem access or where gRPC is accessible across team boundaries.

Affected Systems

Package	Ecosystem	Vulnerable Range	Patched
dagster	pip	< 1.10.16	`1.10.16`

Do you use dagster? You're affected.

Severity & Risk

CVSS 3.1

6.6 / 10

EPSS

0.0%

chance of exploitation in 30 days

Higher than 14% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, CISA SSVC, EPSS, trickest/cve, and Nuclei templates.

Attack Surface

AV Local

AC Low

PR None

UI Required

S Unchanged

C High

I Low

A Low

Recommended Action

6 steps

PATCH

Upgrade dagster to >= 1.10.16 immediately — this is the only complete fix.
NETWORK

Restrict gRPC port access (default 4266) to known orchestration clients only via firewall/security group rules.
LEAST PRIVILEGE

Audit what the Dagster service account can read on the filesystem — restrict to only required directories.
SECRETS MANAGEMENT

Ensure credentials on Dagster hosts are stored in a secrets manager (Vault, AWS Secrets Manager) rather than flat files.
DETECTION

Monitor for gRPC ExternalNotebookData requests containing '..', '%2e', or absolute paths outside the notebook directory. Review Dagster access logs for unusual notebook_path values.
VERIFY

Check git history and access logs for any signs of pre-patch exploitation.

CISA SSVC Assessment

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

Classification

Data Extraction Data Leakage Framework Training Data AML.T0025 - Exfiltration via Cyber Means AML.T0035 - AI Artifact Collection AML.T0037 - Data from Local System AML.T0049 - Exploit Public-Facing Application AML.T0055 - Unsecured Credentials

Compliance Impact

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

6.1.2 - AI risk assessment 8.4 - AI system lifecycle — operational security

NIST AI RMF

MANAGE-2.4 - Risk treatment and response MAP-1.5 - Organizational risk tolerance

OWASP LLM Top 10

LLM05 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2025-51481?

Dagster's gRPC server allows any client with network access to read arbitrary files by injecting path traversal sequences into notebook_path — including credentials, configs, and model artifacts stored on the orchestration host. Patch immediately to 1.10.16; the fix is available and straightforward. If you cannot patch now, restrict gRPC server access to trusted internal hosts via firewall rules.

Is CVE-2025-51481 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2025-51481, increasing the risk of exploitation.

How to fix CVE-2025-51481?

1. PATCH: Upgrade dagster to >= 1.10.16 immediately — this is the only complete fix. 2. NETWORK: Restrict gRPC port access (default 4266) to known orchestration clients only via firewall/security group rules. 3. LEAST PRIVILEGE: Audit what the Dagster service account can read on the filesystem — restrict to only required directories. 4. SECRETS MANAGEMENT: Ensure credentials on Dagster hosts are stored in a secrets manager (Vault, AWS Secrets Manager) rather than flat files. 5. DETECTION: Monitor for gRPC ExternalNotebookData requests containing '..', '%2e', or absolute paths outside the notebook directory. Review Dagster access logs for unusual notebook_path values. 6. VERIFY: Check git history and access logs for any signs of pre-patch exploitation.

What systems are affected by CVE-2025-51481?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, MLOps orchestration, feature engineering pipelines, model deployment automation.

What is the CVSS score for CVE-2025-51481?

CVE-2025-51481 has a CVSS v3.1 base score of 6.6 (MEDIUM). The EPSS exploitation probability is 0.05%.

Technical Details

NVD Description

Local File Inclusion in dagster._grpc.impl.get_notebook_data in Dagster 1.10.14 allows attackers with access to the gRPC server to read arbitrary files by supplying path traversal sequences in the notebook_path field of ExternalNotebookData requests, bypassing the intended extension-based check.

Exploitation Scenario

An adversary with access to a Dagster gRPC endpoint — such as a compromised CI/CD runner, a malicious insider, or a misconfigured internal service — sends a crafted ExternalNotebookData gRPC request with notebook_path set to '../../../../etc/environment' or '../../../../home/dagster/.aws/credentials'. The extension check (intended to allow only .ipynb files) is bypassed via path traversal sequences. The gRPC server reads and returns the file contents. The attacker extracts cloud credentials, uses them to access S3 buckets containing training data or model artifacts, and pivots to compromise the broader ML infrastructure. The entire chain requires no authentication beyond gRPC server access.