Advisoriesby IbisMLflowGHSA-4rj2-9gcx-5qhx
MLflow has Weak Password Requirements
Fix: upgrade to 2.19.0 or later
In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user account management. The issue is fixed in version 2.19.0.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| mlflow PyPI | < 2.19.0 | 2.19.0 |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-521
- Also known as
- BIT-mlflow-2025-1474, CVE-2025-1474, PYSEC-2025-17
More MLflow advisories
All MLflow
MLFlow SSRF via gateway_proxy_handlerCVE-2025-52967fixed in 2.22.2 +1MLflow Cross-Site Request Forgery (CSRF) vulnerabilityCVE-2025-1473fixed in 2.20.3MLflow Uncontrolled Resource Consumption vulnerabilityCVE-2025-0453no fix yetMLflow has a Local File Read/Path Traversal in dbfsCVE-2024-8859fixed in 2.17.0rc0MLflow Uncontrolled Resource Consumption vulnerabilityCVE-2024-6838no fix yetMLflow's excessive directory permissions allow local privilege escalationCVE-2024-27134fixed in 2.16.0