3.8
Low
CVE-2025-1474 In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password
Description
In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user account management. The issue is fixed in version 2.19.0.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| mlflow/mlflow 2.19 | earliest → < 2.19.0 | 2.19.0 |
References
- huntr.com huntr.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of mlflow/mlflow
The 55 CVEs of mlflow/mlflow →
CVE-2026-8147
In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper…
8.1
High
CVE-2026-4035
A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI…
9.1
Critical
CVE-2026-3198
MLflow 3.9.0 with basic-auth (`--app-name basic-auth`) fails to enforce authorization checks for multiple Gateway API…
6.5
Medium
CVE-2026-2651
A vulnerability in MLflow…
9.0
Critical