CVE-2025-52967 MLFlow SSRF via gateway_proxy_handler
Attackers can exploit missing gateway path validation in MLflow to perform Server-Side Request Forgery, potentially accessing internal resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-52967?
CVE-2025-52967 is a medium-severity server-side request forgery vulnerability in lfprojects MLflow, published on 23 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
gateway_proxy_handler in MLflow before 3.1.0 lacks gateway_path validation.
Weakness: CWE-918
Which versions are affected by CVE-2025-52967?
6 open source packages ship an affected version, including mlflow.
| Package | Affected | Fixed in |
|---|---|---|
mlflow Bitnami | All versions | 3.1.0 |
mlflow PyPI | All versions | 2.22.2 |
mlflow PyPI | All versions | 2.22.2 |
mlflow PyPI | All versions | 3.1.0 |
mlflow PyPI | From 3.0.0rc0 | 3.1.0 |
mlflow PyPI | From 3.0.0rc0 | 3.1.0 |
How do I fix CVE-2025-52967?
Upgrade mlflow to a fixed version for your release line: 3.1.0 or 2.22.2.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2025-52967 being exploited?
There is no known exploitation of CVE-2025-52967 in the wild and no public exploit code.
Sources
Also known as BIT-mlflow-2025-52967, GHSA-wxj7-3fx5-pp9m, PYSEC-2025-52.