CVE-2025-1474 — MEDIUM (CVSS 5.5) AI Security Vulnerability

Q: Is CVE-2025-1474 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2025-1474, increasing the risk of exploitation.

Q: How to fix CVE-2025-1474?

1. PATCH: Upgrade to MLflow 2.19.0 immediately (pip install --upgrade mlflow). 2. AUDIT: Query the user table for accounts with null or empty password hashes before patching — the patch may not retroactively fix existing passwordless accounts. 3. HARDEN: Restrict MLflow admin role to named individuals; eliminate shared admin credentials. 4. DETECT: Alert on admin-level user creation events in MLflow audit logs; monitor for logins from unexpected source IPs. 5. ISOLATE: Ensure MLflow UI and REST API are not internet-exposed; enforce network-level controls (VPN, private subnet). 6. ROTATE: Treat any admin-level credentials used in MLflow 2.18 as potentially compromised.

Q: What systems are affected by CVE-2025-1474?

This vulnerability affects the following AI/ML architecture patterns: MLOps platforms, model registries, training pipelines, experiment tracking systems, automated retraining pipelines.

Q: What is the CVSS score for CVE-2025-1474?

CVE-2025-1474 has a CVSS v3.1 base score of 5.5 (MEDIUM). The EPSS exploitation probability is 0.10%.

CISO Take

If your ML teams run MLflow 2.18, patch to 2.19.0 now — a compromised or malicious admin can create passwordless accounts that persist silently even after credential rotations. The real risk is not the CVSS score but the backdoor persistence pattern: an attacker with transient admin access plants a zero-credential account for long-term MLOps access. Audit existing accounts for null passwords before patching.

Risk Assessment

Effective risk is higher than the 5.5 CVSS suggests in enterprise AI contexts. While PR:H limits opportunistic exploitation, insider threat and compromised admin scenarios are realistic in MLOps environments where shared service accounts and weak IAM hygiene are common. MLflow holds model artifacts, experiment metadata, and training lineage — assets with high IP and supply-chain value. EPSS of 0.00091 indicates no active exploitation yet, but the technique is trivial once admin access is obtained.

Affected Systems

Package	Ecosystem	Vulnerable Range	Patched
mlflow	pip	—	No patch
25.7K OpenSSF 4.5 624 dependents Pushed 7d ago 24% patched ~64d to patch Full package profile →
mlflow	pip	< 2.19.0	`2.19.0`
25.7K OpenSSF 4.5 624 dependents Pushed 7d ago 24% patched ~64d to patch Full package profile →

Severity & Risk

CVSS 3.1

5.5 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 28% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, CISA SSVC, EPSS, trickest/cve, and Nuclei templates.

Attack Surface

AV Network

AC Low

PR High

UI None

S Unchanged

C Low

I High

A None

Recommended Action

6 steps

PATCH

Upgrade to MLflow 2.19.0 immediately (pip install --upgrade mlflow).
AUDIT

Query the user table for accounts with null or empty password hashes before patching — the patch may not retroactively fix existing passwordless accounts.
HARDEN

Restrict MLflow admin role to named individuals; eliminate shared admin credentials.
DETECT

Alert on admin-level user creation events in MLflow audit logs; monitor for logins from unexpected source IPs.
ISOLATE

Ensure MLflow UI and REST API are not internet-exposed; enforce network-level controls (VPN, private subnet).
ROTATE

Treat any admin-level credentials used in MLflow 2.18 as potentially compromised.

CISA SSVC Assessment

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

Classification

Auth Bypass Supply Chain Model Poisoning Framework Training Data Model AML.T0010.001 - AI Software AML.T0012 - Valid Accounts AML.T0021 - Establish Accounts AML.T0035 - AI Artifact Collection AML.T0055 - Unsecured Credentials

Compliance Impact

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity Article 9 - Risk management system

ISO 42001

6.1.2 - Information security risk assessment 8.1 - Operational planning and control

NIST AI RMF

GOVERN-1.1 - Policies and procedures for AI risk management MANAGE-2.2 - Mechanisms to sustain oversight of AI

Frequently Asked Questions

What is CVE-2025-1474?

If your ML teams run MLflow 2.18, patch to 2.19.0 now — a compromised or malicious admin can create passwordless accounts that persist silently even after credential rotations. The real risk is not the CVSS score but the backdoor persistence pattern: an attacker with transient admin access plants a zero-credential account for long-term MLOps access. Audit existing accounts for null passwords before patching.

Is CVE-2025-1474 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2025-1474, increasing the risk of exploitation.

How to fix CVE-2025-1474?

1. PATCH: Upgrade to MLflow 2.19.0 immediately (pip install --upgrade mlflow). 2. AUDIT: Query the user table for accounts with null or empty password hashes before patching — the patch may not retroactively fix existing passwordless accounts. 3. HARDEN: Restrict MLflow admin role to named individuals; eliminate shared admin credentials. 4. DETECT: Alert on admin-level user creation events in MLflow audit logs; monitor for logins from unexpected source IPs. 5. ISOLATE: Ensure MLflow UI and REST API are not internet-exposed; enforce network-level controls (VPN, private subnet). 6. ROTATE: Treat any admin-level credentials used in MLflow 2.18 as potentially compromised.

What systems are affected by CVE-2025-1474?

This vulnerability affects the following AI/ML architecture patterns: MLOps platforms, model registries, training pipelines, experiment tracking systems, automated retraining pipelines.

What is the CVSS score for CVE-2025-1474?

CVE-2025-1474 has a CVSS v3.1 base score of 5.5 (MEDIUM). The EPSS exploitation probability is 0.10%.

Technical Details

NVD Description

In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user account management. The issue is fixed in version 2.19.0.

Exploitation Scenario

An insider or attacker with temporary admin access (via phishing a DevOps engineer or exploiting a misconfigured service account) logs into MLflow 2.18 and creates a secondary user account without setting a password. This backdoor account is invisible to standard credential rotation procedures. After the initial admin session is detected and revoked, the adversary authenticates as the passwordless account — no credential to brute-force or rotate — and browses the model registry. They download proprietary model weights from the artifact store, then register a silently modified model version that embeds a backdoor, poisoning the organization's automated retraining pipeline when it promotes the 'latest' registered model to production.