CVE-2025-2129: Mage AI RCE Vulnerability

CVE-2025-2129 Overview

CVE-2025-2129 is a disputed vulnerability affecting Mage AI version 0.9.75, a data pipeline and orchestration platform. The issue stems from insecure default initialization of a resource, classified under [CWE-1188]. According to the public disclosure, the default authentication setup can enable remote attackers to reach functionality that should require authentication. The exploit has been publicly disclosed. Mage AI has declined to treat the report as a valid security vulnerability after seven months of researcher follow-up and has stated it will not issue a fix.

Critical Impact
Remote attackers can potentially interact with a Mage AI 0.9.75 instance that relies on the default initialization state, with the referenced disclosure describing a path toward zero-click remote code execution.

Affected Products

Mage AI 0.9.75
Deployments using default authentication configuration
Internet-exposed Mage AI orchestration instances

Discovery Timeline

2025-03-09 - CVE-2025-2129 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD; vendor confirmed the issue will not be addressed

Technical Details for CVE-2025-2129

Vulnerability Analysis

The vulnerability is categorized as an insecure default initialization of a resource. Mage AI 0.9.75 ships with a default configuration state that does not enforce sufficient controls on sensitive functionality after installation. The referenced write-up titled "Insecure Default Authentication Setup Leading to Zero-Click RCE" describes how an operator who deploys Mage AI without hardening the default state exposes an execution surface reachable over the network.

Attack complexity is described as high, meaning successful exploitation depends on specific conditions of the target deployment rather than a straightforward one-shot request. No privileges or user interaction are required from the target side. Impact on confidentiality, integrity, and availability is limited but non-trivial when the exposed component allows pipeline or code execution primitives.

Mage AI disputes the report. Operators should still treat any Mage AI 0.9.75 instance reachable from untrusted networks as high risk until authentication and network exposure are validated.

Root Cause

The root cause is that Mage AI 0.9.75 does not require secure authentication or restricted access as part of its default resource initialization. Sensitive interfaces are usable in the shipped default state, aligning with the [CWE-1188] pattern of insecure defaults for a resource.

Attack Vector

The attack vector is network based. An attacker who can reach the Mage AI HTTP interface, either directly on the internet or across a flat internal network, can interact with the exposed functionality without supplying credentials. See the GitHub Mage-AI Security Report and the VulDB CTI ID #299049 entry for the disclosed technique.

No verified proof-of-concept code has been supplied for this article. Refer to the linked disclosure for the technical walk-through.

Detection Methods for CVE-2025-2129

Indicators of Compromise

Unexpected pipeline, block, or notebook creation events in Mage AI logs originating from external or unattributed IP addresses.
Outbound network connections from the Mage AI host process to attacker-controlled infrastructure following pipeline execution.
New scheduled triggers or code blocks added without corresponding change-management records.
Access to Mage AI HTTP endpoints without preceding authentication requests in reverse proxy or load balancer logs.

Detection Strategies

Inventory all Mage AI 0.9.75 deployments and confirm whether they run with default configuration values.
Alert on Mage AI application processes spawning shells, interpreters, or system utilities unrelated to defined pipelines.
Correlate Mage AI web interface access from public IP ranges with subsequent code execution activity on the host.

Monitoring Recommendations

Forward Mage AI web server, application, and host process telemetry into a centralized logging or SIEM pipeline for retention and correlation.
Monitor authentication events on the Mage AI interface and flag any successful sensitive action performed without a prior authentication event.
Track egress connections from Mage AI hosts and baseline expected destinations to surface anomalies.

How to Mitigate CVE-2025-2129

Immediate Actions Required

Remove Mage AI 0.9.75 instances from direct internet exposure and place them behind an authenticating reverse proxy or VPN.
Enable and enforce Mage AI's authentication features rather than relying on the shipped default state.
Restrict inbound network access to Mage AI endpoints using firewall or security group rules that allow only known administrative sources.
Rotate any credentials, API tokens, or cloud role bindings accessible from the Mage AI host if exposure is suspected.

Patch Information

No vendor patch is available. Mage AI has declined to classify this report as a security vulnerability and has stated it will not release a fix. Operators must rely on configuration hardening and compensating network controls. Track updates through the VulDB #299049 entry and the VulDB Submission #510690 record.

Workarounds

Configure Mage AI to require authentication on all routes before exposing the service to any user network.
Deploy Mage AI behind an identity-aware proxy that enforces single sign-on and short-lived sessions.
Segment Mage AI workers onto a dedicated network with strict egress filtering to limit post-exploitation movement.
Run Mage AI as a non-privileged user in a container with read-only file system and minimal capabilities to reduce blast radius.

bash

# Example: restrict Mage AI to localhost and front it with an authenticating proxy
export MAGE_HOST=127.0.0.1
export MAGE_PORT=6789

# Firewall rule limiting inbound access to a trusted management subnet
iptables -A INPUT -p tcp --dport 6789 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 6789 -j DROP