Denial of Service through Batched Queries in GraphQL in mlflow/mlflow

Root

Cause

The /graphql endpoint in mlflow version 2.17.2 suffers from uncontrolled resource consumption. An attacker can submit large batches of GraphQL queries that repeatedly request all runs from a given experiment, tying up all available workers and preventing the application from handling other requests [1].

Exploitation

An attacker can exploit this vulnerability by crafting multiple GraphQL queries that each fetch all runs from an experiment. No specific authentication or network position is required beyond access to the endpoint. The attack consists of sending many such queries in parallel, overwhelming the worker pool [1].

Impact

Successful exploitation results in a denial of service condition. The MLflow application becomes unresponsive to legitimate traffic, disrupting AI/ML operations that depend on the service [1].

Mitigation

As of the publication date of this CVE, no official patch has been released. Users are advised to monitor the official mlflow repository for updates and consider applying rate limiting or other resource controls to the /graphql endpoint [2][3].