CVE-2025-1474: MLflow Authentication Bypass Vulnerability

CVE-2025-1474 Overview

CVE-2025-1474 affects MLflow version 2.18, an open-source platform for managing the machine learning lifecycle maintained by the Linux Foundation (LF Projects). The flaw allows an administrator to create a new user account without setting a password. Accounts provisioned without credentials expose the platform to unauthorized access and violate baseline account management controls. The issue is tracked as [CWE-521: Weak Password Requirements] and is fixed in MLflow 2.19.0.

Critical Impact
An admin can create MLflow accounts with no password, producing credential-less accounts that any network-adjacent actor could use to authenticate and interact with tracked models, experiments, and artifacts.

Affected Products

MLflow version 2.18
LF Projects lfprojects:mlflow (versions prior to 2.19.0)
MLflow deployments using the built-in basic authentication provider

Discovery Timeline

2025-03-20 - CVE-2025-1474 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1474

Vulnerability Analysis

MLflow ships an optional basic authentication module under mlflow/server/auth/ that manages user creation, password storage, and permission checks. In version 2.18, the account creation flow did not enforce a minimum password length on either the HTML sign-up form or the corresponding backend handler. An administrator using the create-user workflow could submit an empty password field and the server would persist the account.

The result is a persistent account with an effectively empty credential. Because MLflow's REST endpoints and tracking server rely on basic authentication for user identity, a passwordless account can be used to reach any endpoint the account is authorized for. Impact scales with the account's assigned permissions: read access to experiment metadata, write access to model registry entries, or admin-level control over other users.

Root Cause

The underlying weakness maps to [CWE-521: Weak Password Requirements]. The sign-up form in mlflow/server/auth/__init__.py accepted any string, including an empty value, without validating length or complexity. No server-side check rejected empty passwords before the account was written to the auth database.

Attack Vector

Exploitation requires an authenticated administrator to create the vulnerable account. Once the passwordless account exists, any actor that can reach the MLflow server over the network and knows or guesses the username can authenticate. In shared or multi-tenant ML environments, this converts an admin misconfiguration into a durable, network-reachable authentication bypass path.

python

# Patch excerpt from mlflow/server/auth/__init__.py
# Adds minlength="4" to username and password inputs on the sign-up form
   </div>
   <label for="username">Username:</label>
   <br>
-  <input type="text" id="username" name="username">
+  <input type="text" id="username" name="username" minlength="4">
   <br>
   <label for="password">Password:</label>
   <br>
-  <input type="password" id="password" name="password">
+  <input type="password" id="password" name="password" minlength="4">
   <br>
   <br>
   <input type="submit" value="Sign up">

Source: MLflow commit 149c9e18. The patch enforces a minimum length of 4 characters on both username and password inputs, preventing empty-password account creation from the built-in sign-up form.

Detection Methods for CVE-2025-1474

Indicators of Compromise

Entries in the MLflow auth database (typically basic_auth.db) where the password hash column is empty, null, or matches a hash of an empty string.
Successful HTTP basic-auth requests to /api/2.0/mlflow/* endpoints with an empty password header value.
New user accounts created via POST /api/2.0/mlflow/users/create with no corresponding password provisioning event.

Detection Strategies

Query the MLflow auth store and enumerate any accounts whose stored password field is empty or resolves to the hash of an empty input.
Inspect reverse proxy or ingress logs for Authorization: Basic headers where the base64-decoded value ends in a colon with no trailing characters.
Correlate MLflow admin API activity with subsequent first-time authentications from unusual source IPs for the newly created accounts.

Monitoring Recommendations

Alert on the MLflow version banner reporting 2.18 or earlier on any tracking server exposed to internal or external networks.
Track anomalous account creation volumes in the MLflow auth service and require change tickets for any admin-initiated account provisioning.
Forward MLflow server logs into a centralized logging or SIEM platform and build a rule for successful logins that follow account creation within a short window.

How to Mitigate CVE-2025-1474

Immediate Actions Required

Upgrade MLflow to version 2.19.0 or later, which enforces a minimum password length on the sign-up form.
Audit the MLflow authentication database for any existing accounts with empty or trivially short passwords and disable or reset them.
Restrict administrative access to the MLflow tracking server to a limited set of trusted operators.

Patch Information

The fix is committed upstream in MLflow commit 149c9e18 and shipped in MLflow 2.19.0. The change adds minlength="4" to the username and password fields of the built-in sign-up form. Additional detail is available in the Huntr Security Bounty report.

Workarounds

Place MLflow behind an external identity provider or reverse proxy that enforces its own password policy and multi-factor authentication.
Disable the built-in mlflow.server.auth sign-up flow and provision users only through vetted automation that sets strong passwords.
Network-segment the MLflow tracking server so that it is not reachable from untrusted networks, reducing the exposure of any passwordless accounts.

bash

# Upgrade MLflow to the patched release
pip install --upgrade "mlflow>=2.19.0"

# Verify the installed version
python -c "import mlflow; print(mlflow.__version__)"

# Identify accounts in the basic auth store that may lack a password
# (adjust the path to match your deployment)
sqlite3 /path/to/basic_auth.db \
  "SELECT username FROM users WHERE password_hash IS NULL OR password_hash = '';"