Mlflow CVE-2025-15036

This vulnerability presents significant real-world risk despite requiring user interaction. The CVSS 3.0 score of 9.6 (Critical) reflects network-based attack vector (AV:N), low complexity (AC:L), no authentication required (PR:N), scope change (S:C), and high impact across confidentiality, integrity, and availability. The scope change indicator is particularly concerning as it suggests the vulnerability can affect resources beyond the vulnerable component's security scope-precisely the sandbox escape scenario described. The requirement for user interaction (UI:R) provides some friction, as exploitation requires a user to upload or process a malicious tar.gz file. However, in typical MLflow workflows where users regularly upload model artifacts, experiments, and dependencies as compressed archives, this interaction requirement is easily satisfied through social engineering or by compromising upstream artifact sources. Public exploit code exists via the Huntr bounty platform, lowering the technical barrier to exploitation. The absence of CISA KEV listing suggests no confirmed widespread exploitation campaigns, but the combination of critical CVSS score, public POC, network attack vector, and the prevalence of MLflow in production ML pipelines makes this a genuine priority for organizations using affected versions. The path traversal class (CWE-29) is well-understood and automatable once initial access is achieved.

An attacker crafts a malicious MLflow experiment artifact packaged as a tar.gz file containing directory traversal sequences such as '../../../root/.ssh/authorized_keys' pointing to a malicious SSH key. In a typical attack, the attacker socially engineers a data scientist or ML engineer to import this 'model artifact' or 'experiment dependency' into their MLflow tracking server, or compromises an upstream model registry that feeds artifacts into the target MLflow instance. When MLflow's extract_archive_to_dir function processes this archive, it extracts files to arbitrary locations on the filesystem without path validation. The attacker successfully writes their SSH public key to the server's authorized_keys file, gaining persistent remote access with elevated privileges. In multi-tenant Databricks or shared Kubernetes environments, this could enable lateral movement to other tenants' data and models, or complete compromise of the ML infrastructure. Publicly available exploit code exists, demonstrating proof-of-concept for this attack vector.