CVE-2025-0453: Lfprojects MLflow DoS Vulnerability

CVE-2025-0453 Overview

CVE-2025-0453 is a Denial of Service vulnerability affecting MLflow version 2.17.2. The vulnerability exists in the /graphql endpoint, which can be exploited by attackers to exhaust server resources through large batches of queries that repeatedly request all runs from a given experiment. This uncontrolled resource consumption can tie up all workers allocated by MLflow, rendering the application unable to respond to legitimate requests.

Critical Impact

Attackers can render MLflow instances completely unresponsive by overwhelming the GraphQL endpoint with resource-intensive queries, disrupting machine learning workflows and model management operations.

Affected Products

• MLflow version 2.17.2
• lfprojects MLflow deployments using the GraphQL endpoint

Discovery Timeline

• 2025-03-20 - CVE-2025-0453 published to NVD
• 2025-10-15 - Last updated in NVD database

Technical Details for CVE-2025-0453

Vulnerability Analysis

This vulnerability falls under CWE-410 (Insufficient Resource Pool), indicating a weakness in resource management within the MLflow application. The GraphQL endpoint lacks proper rate limiting and query complexity controls, allowing attackers to submit batched queries that consume excessive server resources.

The attack exploits the inherent flexibility of GraphQL, which allows clients to specify exactly what data they need. Without proper safeguards, an attacker can craft queries that request large amounts of data—specifically all runs from experiments—in a single batched request. When multiple such queries are submitted simultaneously, the MLflow workers become saturated processing these expensive operations.

Root Cause

The root cause is uncontrolled resource consumption in the /graphql endpoint implementation. MLflow fails to implement adequate protections against:

• Query depth limiting
• Query complexity analysis
• Rate limiting on the GraphQL endpoint
• Batch query size restrictions

This allows malicious actors to craft queries that maximize resource consumption while the server processes expensive operations like fetching all experiment runs.

Attack Vector

The attack is network-based and requires no authentication or user interaction to execute. An attacker can exploit this vulnerability remotely by:

1. Identifying an MLflow instance with the /graphql endpoint exposed
2. Crafting GraphQL queries that request all runs from experiments
3. Batching multiple resource-intensive queries together
4. Repeatedly sending these batched requests to exhaust worker pools

The vulnerability mechanism leverages GraphQL's batching capability to amplify the impact of each request. By repeatedly querying for all experiment runs, the attacker can systematically consume all available workers, preventing legitimate users from accessing the MLflow interface or API. For detailed technical information, see the Huntr Vulnerability Disclosure.

Detection Methods for CVE-2025-0453

Indicators of Compromise

• Unusual spike in requests to the /graphql endpoint from single or multiple IP addresses
• Server resource exhaustion symptoms including high CPU/memory utilization during GraphQL processing
• Repeated queries requesting all runs from experiments in rapid succession
• MLflow worker pool saturation with pending GraphQL requests

Detection Strategies

• Monitor request rates to the /graphql endpoint and alert on anomalous traffic patterns
• Implement application-level logging to capture GraphQL query complexity and batch sizes
• Configure network intrusion detection systems to identify DoS attack patterns targeting GraphQL endpoints
• Set up alerts for MLflow worker pool utilization thresholds

Monitoring Recommendations

• Deploy real-time monitoring for MLflow service availability and response times
• Track GraphQL query execution times to identify expensive operations
• Monitor system resource metrics (CPU, memory, network) on MLflow servers
• Implement health check endpoints to detect service degradation early

How to Mitigate CVE-2025-0453

Immediate Actions Required

• Review MLflow deployment configurations and restrict access to the /graphql endpoint
• Implement network-level rate limiting for the GraphQL endpoint using a reverse proxy or WAF
• Consider disabling the GraphQL endpoint if not required for operations
• Deploy a GraphQL gateway with query complexity analysis capabilities

Patch Information

Check the official MLflow releases for patched versions addressing this vulnerability. Monitor the MLflow GitHub repository and security advisories for updates. The Huntr Vulnerability Disclosure contains additional details about the reported issue.

Workarounds

• Implement rate limiting at the reverse proxy or load balancer level for /graphql requests
• Configure firewall rules to restrict access to the GraphQL endpoint to trusted networks only
• Deploy a GraphQL-aware WAF that can analyze and limit query complexity
• Use network segmentation to isolate MLflow instances from untrusted networks

# Example nginx rate limiting configuration for MLflow GraphQL endpoint
# Add to nginx server block

limit_req_zone $binary_remote_addr zone=graphql_limit:10m rate=10r/s;

location /graphql {
    limit_req zone=graphql_limit burst=20 nodelay;
    limit_req_status 429;
    proxy_pass http://mlflow_backend;
}