CVSS 3.1
5.5 mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:NCVE-2025-1474
Medium (5.5) in lfprojects mlflow. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in mlflow 2.19.0.
In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user account management. The issue is fixed in version 2.19.0.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 30% of CVEs (scores of 2026-10-31)
- CWE
- CWE-521
- Published
- Modified
- Record from
- the NVD, synced
Affected
- lfprojects:mlflow
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-4rj2-9gcx-5qhx | PyPI | mlflow | <2.19.0 | 2.19.0 |
| PYSEC-2025-17 | PyPI | mlflow | <2.19.0 | 2.19.0 |