CVE-2025-11200

MLflow Weak Password Requirements Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of passwords. The issue results from weak password requirements. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26916.

An adversary performing reconnaissance against an AI-enabled organization scans for MLflow's default port 5000 or discovers the instance via exposed environment variables or internal documentation. They attempt authentication with a blank password or trivially weak credential (e.g., 'admin'/'admin'), bypassing the authentication check due to CWE-521. Once authenticated, the attacker browses the model registry to identify the organization's production models, downloads them for offline IP theft, and uploads a trojanized version of the most-used model with identical metadata. Because many MLflow deployments use automated promotion pipelines, the poisoned model is promoted to the production serving endpoint without human review. The model now exfiltrates inference inputs or produces subtly manipulated outputs — detected only when downstream business metrics degrade.