CVE-2025-1474: Weak Password Requirements in mlflow/mlflow
First published: Thu Mar 20 2025(Updated: )
In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user account management. The issue is fixed in version 2.19.0.
Credit: security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| MLflow | ||
| MLflow | <2.19.0 | |
| pip/mlflow | <2.19.0 | 2.19.0 |
| MLflow | <2.19.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://huntr.com/bounties/e79f7774-10fe-46b2-b522-e73b748e3b2d
- https://github.com/mlflow/mlflow/commit/149c9e18aa219bc47e86b432e130e467a36f4a17
- https://nvd.nist.gov/vuln/detail/CVE-2025-1474
- https://github.com/advisories/GHSA-4rj2-9gcx-5qhx (Advisory)
- https://github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2025-17.yaml
Frequently Asked Questions
What is the severity of CVE-2025-1474?
CVE-2025-1474 has a significant severity level due to the risk of unauthorized access from accounts created without passwords.
How do I fix CVE-2025-1474?
To fix CVE-2025-1474, ensure that all user accounts are created with strong passwords in MLflow version 2.18 or earlier by upgrading to a secure version.
Which versions of MLflow are affected by CVE-2025-1474?
CVE-2025-1474 affects MLflow version 2.18 and earlier releases.
What are the potential risks associated with CVE-2025-1474?
The potential risks include unauthorized account access and violation of security best practices due to accounts without passwords.
Can an attacker exploit CVE-2025-1474 easily?
Yes, an attacker can easily exploit CVE-2025-1474 by accessing accounts with no password protection.
- agent/title
- agent/weakness
- agent/description
- agent/type
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/author
- agent/references
- agent/source
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/remedy
- agent/severity
- collector/nvd-api
- source/NVD
- agent/softwarecombine
- collector/nvd-cve
- agent/event
- collector/github-advisory
- source/GitHub
- alias/GHSA-4rj2-9gcx-5qhx
- alias/CVE-2025-1474
- agent/tags
- collector/github-advisory-latest
- vendor/mlflow
- canonical/mlflow
- vendor/lfprojects
- package-manager/pip