CVE-2025-1474 - CVE House
Back to Database
Status published Low CVE-2025-1474

Weak Password Requirements in mlflow/mlflow

Vulnerability Description

In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user account management. The issue is fixed in version 2.19.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-1474

Credits & Attribution

No credits recorded in the NVD database.

References

More from mlflow

View All →
CVE-2025-1473
CSRF in mlflow/mlflow
Medium 5.4
CVE-2025-15381
Unauthorized Access to Tracing and Assessment Endpoints in mlflow/mlflow
High 8.1
CVE-2025-15379
Command Injection in mlflow/mlflow
Critical 10
CVE-2025-15036
Path Traversal Vulnerability in mlflow/mlflow
Critical 9.6
CVE-2025-15031
Path Traversal Vulnerability in mlflow/mlflow
High 8.1

Affected Vendor

Affected Software

mlflow/mlflow
Vulnerable Versions:
unspecified

Timeline

Official Publish: March 20th, 2025
Last Modified: March 20th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Weaknesses (CWE)

CWE-521

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.