Validation Flaw in Gateway Proxy Handler of MLflow by Databricks
CVE-2025-52967

5.8MEDIUM

Key Information:

Vendor

Lfprojects

Status
Mlflow
Vendor
CVE Published:
23 June 2025

What is CVE-2025-52967?

The gateway_proxy_handler in MLflow versions before 3.1.0 is susceptible to a validation flaw due to the lack of gateway_path validation. This oversight may expose applications to various security threats, emphasizing the necessity for proper input validation to safeguard against potential exploits.

Affected Version(s)

MLflow 0 < 3.1.0

References

https://github.com/mlflow/mlflow/pull/15970
https://github.com/mlflow/mlflow/issues/15944
https://github.com/mlflow/mlflow/releases/tag/v3.1.0

CVSS V3.1

Score:
5.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-52967 : Validation Flaw in Gateway Proxy Handler of MLflow by Databricks