AI Threat Alert
CVE-2025-1473: MLflow: CSRF in signup allows rogue account creation
GHSA-969w-gqqr-g6j3 HIGH PoC AVAILABLE CISA: TRACK*An attacker can trick any user's browser into registering an attacker-controlled account on your MLflow server, bypassing intended access controls. This gives the attacker a persistent foothold in your ML experiment tracking platform with access to models, artifacts, and potentially training data. Patch to MLflow 2.20.3 immediately and verify your MLflow instance is not publicly reachable without network-level controls.
Risk Assessment
Risk is MEDIUM-HIGH for organizations with internet-exposed MLflow deployments and LOW for those with network-restricted instances. CVSS 7.1 and low attack complexity make this straightforward to exploit, but user interaction is required (victim must visit attacker-controlled page). EPSS of 0.00055 indicates no current observed exploitation in the wild. The confidentiality impact is HIGH because a rogue account grants full access to experiments, registered models, run artifacts, and any secrets stored in MLflow tracking server — making this disproportionately dangerous in AI/ML environments where sensitive model IP and training pipelines live.
Affected Systems
Severity & Risk
Attack Surface
Recommended Action
6 steps-
PATCH
Upgrade MLflow to 2.20.3 immediately (fix commit: ecfa61cb43d3303589f3b5834fd95991c9706628).
-
NETWORK
Restrict MLflow server access to internal networks/VPN — no public exposure without WAF or reverse proxy with CSRF protection.
-
AUDIT
Review user accounts in MLflow for unauthorized registrations post-2025-01-01 (check /api/2.0/mlflow/users/list if using built-in auth).
-
ROTATE
If exposure was possible, rotate any MLflow API tokens and review access logs for anomalous activity.
-
DETECT
Alert on new account creation events in MLflow audit logs; correlate with known IP ranges.
-
WORKAROUND (if patching is delayed): Disable self-registration if not required, or enforce SSO/OIDC via a proxy.
CISA SSVC Assessment
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
Classification
Compliance Impact
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2025-1473?
An attacker can trick any user's browser into registering an attacker-controlled account on your MLflow server, bypassing intended access controls. This gives the attacker a persistent foothold in your ML experiment tracking platform with access to models, artifacts, and potentially training data. Patch to MLflow 2.20.3 immediately and verify your MLflow instance is not publicly reachable without network-level controls.
Is CVE-2025-1473 actively exploited?
Proof-of-concept exploit code is publicly available for CVE-2025-1473, increasing the risk of exploitation.
How to fix CVE-2025-1473?
1. PATCH: Upgrade MLflow to 2.20.3 immediately (fix commit: ecfa61cb43d3303589f3b5834fd95991c9706628). 2. NETWORK: Restrict MLflow server access to internal networks/VPN — no public exposure without WAF or reverse proxy with CSRF protection. 3. AUDIT: Review user accounts in MLflow for unauthorized registrations post-2025-01-01 (check /api/2.0/mlflow/users/list if using built-in auth). 4. ROTATE: If exposure was possible, rotate any MLflow API tokens and review access logs for anomalous activity. 5. DETECT: Alert on new account creation events in MLflow audit logs; correlate with known IP ranges. 6. WORKAROUND (if patching is delayed): Disable self-registration if not required, or enforce SSO/OIDC via a proxy.
What systems are affected by CVE-2025-1473?
This vulnerability affects the following AI/ML architecture patterns: MLOps platforms, model registry, training pipelines, experiment tracking, model serving.
What is the CVSS score for CVE-2025-1473?
CVE-2025-1473 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.16%.
Technical Details
NVD Description
A Cross-Site Request Forgery (CSRF) vulnerability exists in the Signup feature of mlflow/mlflow versions 2.17.0 to 2.20.1. This vulnerability allows an attacker to create a new account, which may be used to perform unauthorized actions on behalf of the malicious user.
Exploitation Scenario
Attacker targets a data science team using MLflow 2.17.x-2.20.1 with its built-in auth. They craft a minimal HTML page with a hidden form auto-submitting a POST to the victim org's MLflow signup endpoint (e.g., https://mlflow.internal/signup) with attacker-chosen credentials. The attacker embeds this in a phishing email or compromised internal wiki page. When a data scientist visits the page — even briefly — their browser silently submits the form using their session context, creating a new attacker-controlled account on the MLflow server. The attacker then logs in at their leisure, exports all registered model versions, downloads artifact stores containing model weights, and reads experiment parameters that may reveal infrastructure details, API keys logged as run params, or proprietary hyperparameter configurations.
Weaknesses (CWE)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N References
Timeline
Related Vulnerabilities
CVE-2025-15379 10.0 MLflow: RCE via unsanitized model dependency specs
Same package: mlflow CVE-2023-3765 10.0 MLflow: path traversal allows arbitrary file read
Same package: mlflow CVE-2026-2635 9.8 mlflow: security flaw enables exploitation
Same package: mlflow CVE-2023-1177 9.8 MLflow: path traversal allows arbitrary file read/write
Same package: mlflow CVE-2023-2780 9.8 MLflow: path traversal allows arbitrary file read/write
Same package: mlflow