GitHub Advisoryadvisory · PyPI

GHSA-4rj2-9gcx-5qhx MLflow has Weak Password Requirements

LOW Published 2025-03-20 Modified 2025-04-09 Official page ↗
Aliases
CVE-2025-1474
Ecosystem
PyPI
Packages
mlflow
Severity
Low
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-521
Reviewed
2025-03-21

Affected packages

• PyPI mlflow: < 2.19.0 → fixed in 2.19.0

Description

In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user account management. The issue is fixed in version 2.19.0.

Related

Alias · CVE (1)

  • CVE-2025-1474 In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. vulnerability

Weakness · CWE (1)

  • CWE-521 Weak Password Requirements weakness

References