CVE-2025-1474
Weak Password Requirements in mlflow/mlflow
In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user account management. The issue is fixed in version 2.19.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Weak Password Requirements in mlflow/mlflow
In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user account management. The issue is fixed in version 2.19.0.
- Record
CVE-2025-1474- CVSS 3.0
- 3.8 Low
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-521
- Updated
- 2026-11-02
EUVDEUVD-2025-6810
In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user account management. The issue is fixed in version 2.19.0.
- Record
EUVD-2025-6810- CVSS 3.0
- 3.8 Low
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-4rj2-9gcx-5qhx
MLflow has Weak Password Requirements
In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user account management. The issue is fixed in version 2.19.0.
- Record
GHSA-4rj2-9gcx-5qhx- CVSS 3.0
- 3.8 Low
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-521
- Updated
- 2026-11-02
NVD
In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user account management. The issue is fixed in version 2.19.0.
- Record
CVE-2025-1474- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N - CVSS 3.0
- 3.8 Low
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-521
- Updated
- 2026-11-02
OSV
Weak Password Requirements in mlflow/mlflow
In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user account management. The issue is fixed in version 2.19.0.
- Record
CVE-2025-1474- CVSS 3.0
- 3.8 Low
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-521
- Updated
- 2026-11-02
OSVGHSA-4rj2-9gcx-5qhx
MLflow has Weak Password Requirements
In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user account management. The issue is fixed in version 2.19.0.
- Record
GHSA-4rj2-9gcx-5qhx- CVSS 3.0
- 3.8 Low
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-521
- Updated
- 2026-11-02
OSVPYSEC-2025-17
In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user account management. The issue is fixed in version 2.19.0.
- Record
PYSEC-2025-17- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N - Updated
- 2026-11-02
OSVBIT-mlflow-2025-1474 No score
Weak Password Requirements in mlflow/mlflow
In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user account management. The issue is fixed in version 2.19.0.
- Record
BIT-mlflow-2025-1474- Updated
- 2026-11-02
OSVCLSA-2026-1787902504 No score
TuxCare security update for mlflow (2 CVEs)
TuxCare rebuilt mlflow to address 2 CVEs. Fixed in 2.9.1.post7+tuxcare.
- Record
CLSA-2026-1787902504- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mlflowPyPI |
before 2.19.0 | 2.19.0 |
mlflowBitnami |
before 2.19.0 | 2.19.0 |
mlflowTuxCare:PyPI From an advisory covering 2 CVEs |
2.9.1 up to 2.9.1.post7+tuxcare, plus listed versions 2.9.1.post1+tuxcare2.9.1.post2+tuxcare2.9.1.post3+tuxcare2.9.1.post4+tuxcare2.9.1.post5+tuxcare2.9.1.post6+tuxcare |
2.9.1.post7+tuxcare |
mlflowPyPI |
before 2.19.0, plus listed versions 0.0.10.1.00.2.00.2.10.3.0 Show 45 moreShow less0.4.00.4.10.4.20.5.00.5.10.5.20.6.00.7.00.8.00.8.10.8.20.9.00.9.0.10.9.11.0.01.1.01.1.1.dev01.10.01.11.01.12.01.12.11.131.13.11.14.01.14.11.15.01.16.01.17.01.18.01.19.01.2.01.20.01.20.11.20.21.21.01.22.01.23.01.23.11.24.01.25.01.25.11.26.01.26.11.27.01.28.0 |
2.19.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-1474 is a low vulnerability (CVSS 3.8) in Lfprojects Mlflow, published March 20, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 30th percentile. Fixed in mlflow 2.19.0.
References
huntr.com/bounties/e79f7774-10fe-46b2-b522-e73b748e3b2d
github.com/mlflow/mlflow/commit/149c9e18aa219bc47e86b432e130e467a36f4a17
nvd.nist.gov/vuln/detail/CVE-2025-1474
Left out here: 69 versions. The JSON record has them.