CVE-2025-1474

Published: Mar 20, 2025Modified: Jun 17, 2026

5.5

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N

Exploitability: 1.2 / Impact: 4.2

Source: NVD

Description

In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user account management. The issue is fixed in version 2.19.0.

Affected (1)

Products: Lfprojects: Mlflow

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Lfprojects Mlflow	Before 2.19.0

Related CWEs

Weak Password Requirements

The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.

References (2)

https://github.com/mlflow/mlflow/commit/149c9e18aa219bc47e86b432e130e467a36f4a17

Source: security@huntr.dev

Patch

https://huntr.com/bounties/e79f7774-10fe-46b2-b522-e73b748e3b2d

Source: security@huntr.dev

ExploitThird Party Advisory

Timeline

No history available yet.