Skip to content
OpenAdvisories
Low · 3.8 CVE-2025-1474 BIT-mlflow-2025-1474EUVD-2025-6810GHSA-4rj2-9gcx-5qhxPYSEC-2025-17

Weak Password Requirements in mlflow/mlflow

Published Mar 20, 2025 · Updated Mar 20, 2025 · Assigned by @huntr_ai

Description

In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user account management. The issue is fixed in version 2.19.0.

Affected products

VendorProductAffectedFixed
mlflow mlflow/mlflow unspecified – < 2.19.0 2.19.0

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI mlflow < 2.19.0 2.19.0 GHSA-4rj2-9gcx-5qhx

References