CyberRota Analysis
AI-GeneratedThe vulnerability affects the ml-metadata component due to an outdated statically-linked gRPC stack, which is susceptible to known HTTP/2 denial of service (DoS) attacks. An attacker with network access to the MLMD pod can exploit this flaw by sending crafted HTTP/2 requests, potentially crashing the pod and disrupting all pipeline operations within the affected namespace. Organizations utilizing ml-metadata in their machine learning workflows should prioritize addressing this vulnerability to maintain service availability and operational integrity.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A flaw was found in ml-metadata. The statically-linked gRPC stack in ml-metadata is outdated, making it vulnerable to known HTTP/2 denial of service (DoS) issues. An in-cluster attacker, with network access to the MLMD pod, could exploit these vulnerabilities by sending specially crafted HTTP/2 requests. This could lead to a denial of service by crashing the MLMD pod, disrupting all pipeline runs in the affected namespace.