CVE-2025-14279: 
NixOS vulnerability analysis and mitigation

CVE-2025-14279 is a DNS rebinding vulnerability in the MLflow REST server caused by a lack of Origin header validation. It affects MLflow versions up to and including 3.4.0, allowing malicious websites to bypass Same-Origin Policy (SOP) protections and make unauthorized calls to REST endpoints. The vulnerability was published on January 12, 2026, and is classified as CWE-346 (Origin Validation Error). It carries a CVSS v3.0 base score of 8.1 (High), assigned by huntr.dev (Feedly, huntr Advisory).

The root cause is the absence of Origin header validation in the MLflow REST server (CWE-346), which enables DNS rebinding attacks. In a DNS rebinding attack, an attacker registers a malicious domain that initially resolves to an attacker-controlled server, then re-binds the DNS to the victim's localhost or internal IP where MLflow is running. A victim's browser, tricked into visiting the malicious site, then makes cross-origin requests to the MLflow REST API — which the server accepts because it does not validate the Origin or Host headers. This allows the attacker's JavaScript to interact with MLflow REST endpoints as if it were a same-origin request. The fix, introduced in MLflow 3.5.0, adds a security middleware layer that validates Host headers and enforces CORS policies (GitHub Commit, huntr Advisory).

Successful exploitation allows an unauthenticated attacker to query, update, and delete MLflow experiments via the affected REST endpoints, leading to potential data exfiltration, destruction, or manipulation of machine learning experiment data. The attack has high confidentiality and integrity impact (CVSS C:H/I:H) but no direct availability impact. Because MLflow is commonly used to track sensitive ML model training runs, hyperparameters, and metrics, unauthorized access could expose proprietary model data or allow an adversary to corrupt experiment records, undermining the integrity of ML pipelines (Feedly, huntr Advisory).

A proof-of-concept exploit is publicly available on huntr.com, but there is no evidence of active in-the-wild exploitation at this time. The attack requires user interaction (a victim must visit a malicious website) but requires no privileges, making it accessible to unauthenticated attackers. The EPSS score is approximately 0.017% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Qualys has added detection for this CVE (Detection ID: 530824) (Feedly, huntr Advisory).

1. Reconnaissance: Identify targets running MLflow tracking servers (versions ≤ 3.4.0) accessible from a browser context — typically on localhost:5000 or an internal network address — using network scanning or by targeting known MLflow default ports.
2. Set up malicious domain: Register an attacker-controlled domain and configure its DNS TTL to a very short value (e.g., 1 second) so the DNS record can be quickly re-bound.
3. Serve initial malicious page: Host a web page on the attacker's domain that the victim is tricked into visiting (e.g., via phishing). The page loads JavaScript that begins polling the MLflow REST API.
4. DNS rebinding: After the initial DNS TTL expires, update the DNS record to resolve the attacker's domain to 127.0.0.1 (or the internal IP of the MLflow server). The victim's browser now treats requests to the attacker's domain as same-origin with the MLflow server.
5. Execute unauthorized API calls: The attacker's JavaScript makes HTTP requests (GET, POST, DELETE) to MLflow REST endpoints (e.g., /api/2.0/mlflow/experiments/list, /api/2.0/mlflow/experiments/delete) through the victim's browser. Since MLflow does not validate the Origin or Host header, these requests are accepted.
6. Exfiltrate or manipulate data: The attacker reads experiment metadata, model parameters, and metrics (data exfiltration), or deletes/modifies experiments (data destruction/manipulation), with results returned to the attacker's server (huntr Advisory, GitHub Commit).

• Network: Unexpected HTTP requests to MLflow REST API endpoints (e.g., /api/2.0/mlflow/experiments/list, /api/2.0/mlflow/experiments/delete, /api/2.0/mlflow/runs/search) originating from browser-based clients (identifiable by User-Agent headers typical of browsers); outbound data transfers from the MLflow server to unknown external IPs.
• Logs: MLflow access logs showing REST API calls with Origin or Referer headers pointing to unfamiliar or external domains; unusual DELETE or UPDATE requests to experiment endpoints outside of normal operational hours or from unexpected source IPs.
• Application Behavior: Unexpected deletion or modification of MLflow experiments or runs with no corresponding user activity in audit logs; sudden disappearance of experiment records or altered metric/parameter values.

Upgrade MLflow to version 3.5.0 or later, which introduces a security middleware layer providing DNS rebinding protection (Host header validation), CORS enforcement, and clickjacking prevention via X-Frame-Options. For organizations unable to patch immediately, implement network-level controls to restrict access to the MLflow REST server (e.g., firewall rules limiting access to trusted IPs only), and educate users to avoid visiting untrusted websites while authenticated to MLflow. As a temporary measure, deploy a reverse proxy (NGINX, Apache httpd) in front of MLflow that enforces Host and Origin header validation, or use the --disable-security-middleware flag only when such a proxy is in place. After upgrading, configure the --allowed-hosts and --cors-allowed-origins options to explicitly whitelist trusted domains (GitHub Commit, Feedly).

The vulnerability was reported through the huntr bug bounty platform and received coverage from security aggregators and community feeds shortly after publication on January 12, 2026. Social media posts on Bluesky and Mastodon noted the disclosure, and security news outlets including The Hacker Wire covered it. Qualys added detection support in their January 2026 application security detections release. No major vendor statements beyond the patch commit have been issued (Feedly).