CVE-2025-1474
published 2025-03-20CVE-2025-1474: In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as…
PriorityP431medium5.5CVSS 3.1
AVNACLPRHUINSUCLIHAN
EPSS
0.34%
25.4th percentile
In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user account management. The issue is fixed in version 2.19.0.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| lfprojects | mlflow | < 2.19.0 | 2.19.0 |
| lfprojects | mlflow | >= 0 < 2.19.0 | 2.19.0 |
| lfprojects | mlflow | >= 0 < 149c9e18aa219bc47e86b432e130e467a36f4a17 | 149c9e18aa219bc47e86b432e130e467a36f4a17 |
| mlflow | mlflow_mlflow | >= unspecified < 2.19.0 | 2.19.0 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N
nvdv3.03.8LOWCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
MLflow has Weak Password Requirements
ghsa·2025-03-20
CVE-2025-1474 [LOW] CWE-521 MLflow has Weak Password Requirements
MLflow has Weak Password Requirements
In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user account management. The issue is fixed in version 2.19.0.
OSV
MLflow has Weak Password Requirements
osv·2025-03-20
CVE-2025-1474 [LOW] MLflow has Weak Password Requirements
MLflow has Weak Password Requirements
In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user account management. The issue is fixed in version 2.19.0.
OSV
CVE-2025-1474: In mlflow/mlflow version 2
osv·2025-03-20
CVE-2025-1474 CVE-2025-1474: In mlflow/mlflow version 2
In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user account management. The issue is fixed in version 2.19.0.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-03-20
Published