Denial of Service Vulnerability in MLflow by Databricks

CVE-2025-0453

What is CVE-2025-0453?

In MLflow version 2.17.2, the application contains a vulnerability at the /graphql endpoint that permits an attacker to execute a denial of service attack. By sending large batches of queries that continuously request all runs from a specified experiment, the attacker can monopolize all allocated workers within MLflow. This excessive consumption of resources prevents the application from responding to other legitimate user requests, thereby compromising its availability. Addressing this vulnerability is crucial to maintain optimal performance and security for MLflow users.

References