Description

A flaw was found in ml-metadata. The statically-linked gRPC stack in ml-metadata is outdated, making it vulnerable to known HTTP/2 denial of service (DoS) issues. An in-cluster attacker, with network access to the MLMD pod, could exploit these vulnerabilities by sending specially crafted HTTP/2 requests. This could lead to a denial of service by crashing the MLMD pod, disrupting all pipeline runs in the affected namespace.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-10T21:17:20.370Z",
  "pubdate": "2026-08-10T21:17:20.370Z",
  "executiveSummary": "A denial of service vulnerability exists within the ml-metadata (MLMD) product due to an outdated and statically-linked gRPC stack. The flaw exposes the affected systems to known HTTP/2 denial of service vulnerabilities.\nSuccessful exploitation of this vulnerability allows an attacker to crash the MLMD pod by transmitting specially crafted HTTP/2 requests, leading to the disruption of all active pipeline runs within the affected namespace.\nThe primary impact of this vulnerability is the complete availability disruption of metadata services and dependent machine learning pipelines operating inside the cluster.\nThe risk implication is severe for environments relying on shared cluster namespaces, as a service outage halts critical operational pipelines and disrupts automated machine learning workflows.\nThe required attacker capabilities include network access to the MLMD pod, typically achievable by an in-cluster adversary with localized network positioning.\nExploitation requirements necessitate that the threat actor possesses direct network reachability to the vulnerable MLMD pod to dispatch the malicious HTTP/2 traffic payloads.",
  "technicalDetails": "The root cause of the vulnerability resides in the statically-linked gRPC stack embedded within ml-metadata, which contains unresolved security defects associated with HTTP/2 protocol processing.\nThe vulnerable component is the internal gRPC networking library utilized by the MLMD pod for handling remote procedure calls and incoming communication streams.\nExploitation occurs via the network layer where an adversary sends specially crafted HTTP/2 requests designed to trigger resource exhaustion or unhandled exceptions within the outdated gRPC stack.\nThe attack flow begins when an in-cluster attacker leverages their network access to establish a communication channel with the MLMD pod.\nThe attacker then transmits malicious HTTP/2 frames or sequences that exploit known parsing or state-handling flaws in the legacy gRPC implementation.\nUpon receiving the malicious payload, the vulnerable gRPC stack fails to process the requests safely, resulting in an abnormal termination or crash of the host process.\nAuthentication requirements are minimal or nonexistent at the gRPC transport layer if network policies permit unauthenticated internal cluster traffic, allowing direct interaction with the endpoint.\nPrivilege requirements are limited to low-privileged in-cluster access, requiring only the ability to route network packets to the targeted MLMD pod IP address and port.\nNetwork exposure is restricted to the internal cluster network, making this primarily an internal threat vector exploitable by compromised pods or malicious tenants residing within the same cluster namespace.\nThe payload behavior involves abusing protocol-level edge cases or resource-intensive HTTP/2 control mechanisms that overwhelm the outdated runtime environment.\nThe post-exploitation impact centers on a denial of service condition, terminating the MLMD process and causing cascading failures across all dependant pipeline runs executing within the affected namespace."
}