What’s Vulnerable › Vulnerabilities

CVE-2025-1474: Weak Password Requirements in mlflow/mlflow

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-03-20 · updated 2026-06-17
• Weakness: CWE-521

Description

In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user account management. The issue is fixed in version 2.19.0.

Affected products

• mlflow/mlflow: before 2.19.0 — fixed in 2.19.0

How to fix

Upgrade to a fixed version: mlflow/mlflow 2.19.0. Check the vendor advisory for mitigations.

References

• https://github.com/mlflow/mlflow/commit/149c9e18aa219bc47e86b432e130e467a36f4a17
• https://huntr.com/bounties/e79f7774-10fe-46b2-b522-e73b748e3b2d

Get alerted when CVE-2025-1474 or the next vulnerability affects your stack