CVE-2025-52967 Overview
CVE-2025-52967 affects MLflow versions before 3.1.0. The gateway_proxy_handler function lacks validation of the gateway_path parameter. This missing validation enables Server-Side Request Forgery (SSRF) attacks against the MLflow gateway proxy component. Attackers can coerce the MLflow server to send crafted HTTP requests to arbitrary destinations reachable from the server, including internal network resources.
MLflow is an open-source machine learning lifecycle management platform commonly deployed in enterprise ML pipelines. The vulnerability is classified under CWE-918: Server-Side Request Forgery.
Critical Impact
Unauthenticated attackers can abuse the MLflow gateway proxy to reach internal services, potentially exposing cloud metadata endpoints, internal APIs, and other network resources unreachable from the public internet.
Affected Products
- MLflow versions prior to 3.1.0
- Deployments exposing the MLflow gateway proxy endpoint
- ML pipelines and MLOps platforms embedding vulnerable MLflow builds
Discovery Timeline
- 2025-06-23 - CVE-2025-52967 published to NVD
- 2026-06-17 - Last updated in NVD database
- v3.1.0 - Fixed in MLflow release v3.1.0 via pull request #15970
Technical Details for CVE-2025-52967
Vulnerability Analysis
The flaw resides in the gateway_proxy_handler function within MLflow's gateway component. The handler accepts a gateway_path parameter and forwards HTTP requests to the resolved destination without enforcing an allowlist or validating the target. An attacker with network access to the MLflow server can supply a manipulated gateway_path value to reach hosts and services the server can contact.
The scope of the SSRF is limited to integrity impact under the assigned scoring. Successful exploitation does not directly return confidential response data to the caller, but it enables the attacker to trigger requests against internal endpoints. This includes cloud instance metadata services, internal management APIs, and lateral service enumeration inside the trust boundary.
Details and the associated fix are tracked in GitHub issue #15944.
Root Cause
The root cause is missing input validation on the gateway_path parameter. The proxy handler trusts caller-supplied path data and constructs outbound requests without verifying that the target matches a configured gateway route. Absence of allowlisting turns a legitimate proxy feature into an open request forwarder.
Attack Vector
Exploitation requires network access to the MLflow gateway endpoint. No authentication or user interaction is needed. An attacker sends an HTTP request to the vulnerable handler with a crafted gateway_path that redirects the server-side request to an internal or otherwise restricted resource. The MLflow process then issues that request from its own network position.
No verified public proof-of-concept exploit is available. See pull request #15970 for the patch implementing path validation.
Detection Methods for CVE-2025-52967
Indicators of Compromise
- Outbound HTTP requests from the MLflow server to cloud metadata addresses such as 169.254.169.254 or link-local ranges.
- MLflow gateway access logs showing unexpected gateway_path values pointing to internal IP addresses or non-configured hosts.
- Unusual DNS lookups originating from the MLflow process for internal hostnames.
Detection Strategies
- Inspect MLflow gateway request logs for gateway_path values that do not match declared routes in the gateway configuration.
- Correlate MLflow process network activity with expected model backend destinations and alert on deviations.
- Deploy egress filtering on MLflow hosts and log denied connections as high-signal indicators.
Monitoring Recommendations
- Monitor the MLflow version reported by running instances and flag deployments below 3.1.0.
- Track HTTP 4xx and 5xx spikes on the gateway endpoint that may indicate probing.
- Baseline outbound connections from MLflow servers and alert on connections to RFC1918 ranges the workload does not normally contact.
How to Mitigate CVE-2025-52967
Immediate Actions Required
- Upgrade MLflow to version 3.1.0 or later on all servers running the gateway component.
- Restrict network access to the MLflow gateway endpoint to trusted clients only.
- Apply strict egress filtering on MLflow hosts to block traffic to cloud metadata services and internal management networks.
Patch Information
MLflow 3.1.0 introduces validation for the gateway_path parameter in gateway_proxy_handler. Refer to the MLflow v3.1.0 release notes and the fix in pull request #15970. Upgrading is the recommended remediation.
Workarounds
- Place the MLflow gateway behind an authenticated reverse proxy that enforces path allowlisting.
- Block outbound access from MLflow hosts to instance metadata endpoints such as 169.254.169.254 using host firewalls or security groups.
- Disable the gateway proxy functionality if it is not required by the deployment.
# Upgrade MLflow to a patched version
pip install --upgrade 'mlflow>=3.1.0'
# Verify installed version
python -c "import mlflow; print(mlflow.__version__)"
# Example iptables rule to block cloud metadata egress from MLflow host
iptables -A OUTPUT -d 169.254.169.254 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
