CVE-2025-0453: Lfprojects MLflow DoS Vulnerability

CVE-2025-0453 Overview

CVE-2025-0453 is a Denial of Service vulnerability affecting MLflow version 2.17.2. The vulnerability exists in the /graphql endpoint, which can be exploited by attackers to exhaust server resources through large batches of queries that repeatedly request all runs from a given experiment. This uncontrolled resource consumption can tie up all workers allocated by MLflow, rendering the application unable to respond to legitimate requests.

Critical Impact
Attackers can render MLflow instances completely unresponsive by overwhelming the GraphQL endpoint with resource-intensive queries, disrupting machine learning workflows and model management operations.

Affected Products

MLflow version 2.17.2
lfprojects MLflow deployments using the GraphQL endpoint

Discovery Timeline

2025-03-20 - CVE-2025-0453 published to NVD
2025-10-15 - Last updated in NVD database

Technical Details for CVE-2025-0453

Vulnerability Analysis

This vulnerability falls under CWE-410 (Insufficient Resource Pool), indicating a weakness in resource management within the MLflow application. The GraphQL endpoint lacks proper rate limiting and query complexity controls, allowing attackers to submit batched queries that consume excessive server resources.

The attack exploits the inherent flexibility of GraphQL, which allows clients to specify exactly what data they need. Without proper safeguards, an attacker can craft queries that request large amounts of data—specifically all runs from experiments—in a single batched request. When multiple such queries are submitted simultaneously, the MLflow workers become saturated processing these expensive operations.

Root Cause

The root cause is uncontrolled resource consumption in the /graphql endpoint implementation. MLflow fails to implement adequate protections against:

Query depth limiting
Query complexity analysis
Rate limiting on the GraphQL endpoint
Batch query size restrictions

This allows malicious actors to craft queries that maximize resource consumption while the server processes expensive operations like fetching all experiment runs.

Attack Vector

The attack is network-based and requires no authentication or user interaction to execute. An attacker can exploit this vulnerability remotely by:

Identifying an MLflow instance with the /graphql endpoint exposed
Crafting GraphQL queries that request all runs from experiments
Batching multiple resource-intensive queries together
Repeatedly sending these batched requests to exhaust worker pools

The vulnerability mechanism leverages GraphQL's batching capability to amplify the impact of each request. By repeatedly querying for all experiment runs, the attacker can systematically consume all available workers, preventing legitimate users from accessing the MLflow interface or API. For detailed technical information, see the Huntr Vulnerability Disclosure.

Detection Methods for CVE-2025-0453

Indicators of Compromise

Unusual spike in requests to the /graphql endpoint from single or multiple IP addresses
Server resource exhaustion symptoms including high CPU/memory utilization during GraphQL processing
Repeated queries requesting all runs from experiments in rapid succession
MLflow worker pool saturation with pending GraphQL requests

Detection Strategies

Monitor request rates to the /graphql endpoint and alert on anomalous traffic patterns
Implement application-level logging to capture GraphQL query complexity and batch sizes
Configure network intrusion detection systems to identify DoS attack patterns targeting GraphQL endpoints
Set up alerts for MLflow worker pool utilization thresholds

Monitoring Recommendations

Deploy real-time monitoring for MLflow service availability and response times
Track GraphQL query execution times to identify expensive operations
Monitor system resource metrics (CPU, memory, network) on MLflow servers
Implement health check endpoints to detect service degradation early

How to Mitigate CVE-2025-0453

Immediate Actions Required

Review MLflow deployment configurations and restrict access to the /graphql endpoint
Implement network-level rate limiting for the GraphQL endpoint using a reverse proxy or WAF
Consider disabling the GraphQL endpoint if not required for operations
Deploy a GraphQL gateway with query complexity analysis capabilities

Patch Information

Check the official MLflow releases for patched versions addressing this vulnerability. Monitor the MLflow GitHub repository and security advisories for updates. The Huntr Vulnerability Disclosure contains additional details about the reported issue.

Workarounds

Implement rate limiting at the reverse proxy or load balancer level for /graphql requests
Configure firewall rules to restrict access to the GraphQL endpoint to trusted networks only
Deploy a GraphQL-aware WAF that can analyze and limit query complexity
Use network segmentation to isolate MLflow instances from untrusted networks

bash

# Example nginx rate limiting configuration for MLflow GraphQL endpoint
# Add to nginx server block

limit_req_zone $binary_remote_addr zone=graphql_limit:10m rate=10r/s;

location /graphql {
    limit_req zone=graphql_limit burst=20 nodelay;
    limit_req_status 429;
    proxy_pass http://mlflow_backend;
}