CVE-2025-1474: MLflow passwordless accounts enable

Q: Is CVE-2025-1474 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2025-1474, increasing the risk of exploitation.

Q: How to fix CVE-2025-1474?

1. PATCH: Upgrade to MLflow 2.19.0 immediately (pip install --upgrade mlflow). 2. AUDIT: Query the user table for accounts with null or empty password hashes before patching — the patch may not retroactively fix existing passwordless accounts. 3. HARDEN: Restrict MLflow admin role to named individuals; eliminate shared admin credentials. 4. DETECT: Alert on admin-level user creation events in MLflow audit logs; monitor for logins from unexpected source IPs. 5. ISOLATE: Ensure MLflow UI and REST API are not internet-exposed; enforce network-level controls (VPN, private subnet). 6. ROTATE: Treat any admin-level credentials used in MLflow 2.18 as potentially compromised.

Q: What systems are affected by CVE-2025-1474?

This vulnerability affects the following AI/ML architecture patterns: MLOps platforms, model registries, training pipelines, experiment tracking systems, automated retraining pipelines.

Q: What is the CVSS score for CVE-2025-1474?

CVE-2025-1474 has a CVSS v3.1 base score of 5.5 (MEDIUM). The EPSS exploitation probability is 0.34%.

CISO Take

If your ML teams run MLflow 2.18, patch to 2.19.0 now — a compromised or malicious admin can create passwordless accounts that persist silently even after credential rotations. The real risk is not the CVSS score but the backdoor persistence pattern: an attacker with transient admin access plants a zero-credential account for long-term MLOps access. Audit existing accounts for null passwords before patching.

What is the risk?

Effective risk is higher than the 5.5 CVSS suggests in enterprise AI contexts. While PR:H limits opportunistic exploitation, insider threat and compromised admin scenarios are realistic in MLOps environments where shared service accounts and weak IAM hygiene are common. MLflow holds model artifacts, experiment metadata, and training lineage — assets with high IP and supply-chain value. EPSS of 0.00091 indicates no active exploitation yet, but the technique is trivial once admin access is obtained.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
MLflow	pip	—	No patch
26.6K OpenSSF 5.6 655 dependents Pushed 4d ago 31% patched ~51d to patch Full package profile →
MLflow	pip	< 2.19.0	`2.19.0`
26.6K OpenSSF 5.6 655 dependents Pushed 4d ago 31% patched ~51d to patch Full package profile →

How severe is it?

CVSS 3.1

5.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 25% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR High

UI None

S Unchanged

C Low

I High

A None

What should I do?

6 steps

PATCH

Upgrade to MLflow 2.19.0 immediately (pip install --upgrade mlflow).
AUDIT

Query the user table for accounts with null or empty password hashes before patching — the patch may not retroactively fix existing passwordless accounts.
HARDEN

Restrict MLflow admin role to named individuals; eliminate shared admin credentials.
DETECT

Alert on admin-level user creation events in MLflow audit logs; monitor for logins from unexpected source IPs.
ISOLATE

Ensure MLflow UI and REST API are not internet-exposed; enforce network-level controls (VPN, private subnet).
ROTATE

Treat any admin-level credentials used in MLflow 2.18 as potentially compromised.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Supply Chain Model Poisoning Framework Training Data Model AML.T0010.001 - AI Software AML.T0012 - Valid Accounts AML.T0021 - Establish Accounts AML.T0035 - AI Artifact Collection AML.T0055 - Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity Article 9 - Risk management system

ISO 42001

6.1.2 - Information security risk assessment 8.1 - Operational planning and control

NIST AI RMF

GOVERN-1.1 - Policies and procedures for AI risk management MANAGE-2.2 - Mechanisms to sustain oversight of AI

Frequently Asked Questions

What is CVE-2025-1474?

If your ML teams run MLflow 2.18, patch to 2.19.0 now — a compromised or malicious admin can create passwordless accounts that persist silently even after credential rotations. The real risk is not the CVSS score but the backdoor persistence pattern: an attacker with transient admin access plants a zero-credential account for long-term MLOps access. Audit existing accounts for null passwords before patching.

Is CVE-2025-1474 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2025-1474, increasing the risk of exploitation.

How to fix CVE-2025-1474?

1. PATCH: Upgrade to MLflow 2.19.0 immediately (pip install --upgrade mlflow). 2. AUDIT: Query the user table for accounts with null or empty password hashes before patching — the patch may not retroactively fix existing passwordless accounts. 3. HARDEN: Restrict MLflow admin role to named individuals; eliminate shared admin credentials. 4. DETECT: Alert on admin-level user creation events in MLflow audit logs; monitor for logins from unexpected source IPs. 5. ISOLATE: Ensure MLflow UI and REST API are not internet-exposed; enforce network-level controls (VPN, private subnet). 6. ROTATE: Treat any admin-level credentials used in MLflow 2.18 as potentially compromised.

What systems are affected by CVE-2025-1474?

This vulnerability affects the following AI/ML architecture patterns: MLOps platforms, model registries, training pipelines, experiment tracking systems, automated retraining pipelines.

What is the CVSS score for CVE-2025-1474?

CVE-2025-1474 has a CVSS v3.1 base score of 5.5 (MEDIUM). The EPSS exploitation probability is 0.34%.

What is the AI security impact?

Affected AI Architectures

MLOps platformsmodel registriestraining pipelinesexperiment tracking systemsautomated retraining pipelines

MITRE ATLAS Techniques

AML.T0010.001 AI Software

AML.T0012 Valid Accounts

AML.T0021 Establish Accounts

AML.T0035 AI Artifact Collection

AML.T0055 Unsecured Credentials

Compliance Controls Affected

EU AI Act: Article 15, Article 9

ISO 42001: 6.1.2, 8.1

NIST AI RMF: GOVERN-1.1, MANAGE-2.2

What are the technical details?

Original Advisory

In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user account management. The issue is fixed in version 2.19.0.

Exploitation Scenario

An insider or attacker with temporary admin access (via phishing a DevOps engineer or exploiting a misconfigured service account) logs into MLflow 2.18 and creates a secondary user account without setting a password. This backdoor account is invisible to standard credential rotation procedures. After the initial admin session is detected and revoked, the adversary authenticates as the passwordless account — no credential to brute-force or rotate — and browses the model registry. They download proprietary model weights from the artifact store, then register a silently modified model version that embeds a backdoor, poisoning the organization's automated retraining pipeline when it promotes the 'latest' registered model to production.

Weaknesses (CWE)

CWE-521 Weak Password Requirements Primary CWE-521 Weak Password Requirements

CWE-521 — Weak Password Requirements: The product does not require that users should have strong passwords.

[Architecture and Design] A product's design should require adherance to an appropriate password policy. Specific password requirements depend strongly on contextual factors, but it is recommended to contain the following attributes: Depending on the threat model, the password policy may include several additional attributes. See NIST 800-63B [REF-1053] for further information on password requirements. Enforcement of a minimum and maximum length Restrictions against password reuse Restrictions against using common passwords Restrictions against using contextual string in the password (e.g., user id, app name) Increasing the range of characters makes the password harder to crack and may be appropriate for systems relying on single factor authentication. Unfortunately, a complex password may be difficult to memorize, encouraging a user to select a short password or to incorrectly manage the password (write it down). Another disadvantage of this approach is that it often does not result in a significant increases
[Architecture and Design] Consider a second authentication factor beyond the password, which prevents the password from being a single point of failure. See CWE-308 for further information.

Source: MITRE CWE corpus.