CVE-2025-11200

What it actually does

The flaw is an authentication bypass caused by insufficient password-strength handling in affected MLflow installations. A remote, unauthenticated attacker may be able to satisfy or circumvent password validation logic and gain access as an authenticated user without possessing a legitimate strong secret. Because MLflow commonly stores experiment metadata, model artifacts, run parameters, credentials in tracking configurations, and deployment-related references, successful exploitation can expose sensitive ML/AI assets and may enable modification or deletion of experiments, models, and artifacts depending on the permissions granted after bypass.

Why it matters to the business

An exposed vulnerable MLflow service could allow an outside attacker to access or alter machine-learning experiments, model artifacts, and operational metadata without valid credentials. This can lead to theft of proprietary models or training information, tampering with model lineage, disruption of ML pipelines, and loss of trust in published models. The CVSS score is critical, but EPSS is currently low and the issue is not listed in CISA KEV, so prioritize internet-facing or shared MLflow deployments first, then internal instances that contain sensitive models, credentials, or production pipeline metadata.

How an attack unfolds

An attacker first identifies an exposed MLflow tracking server or related deployment that has authentication enabled but is running a vulnerable build. Because exploitation does not require prior authentication, the attacker can interact directly with the login, password setup, password reset, or credential validation paths. By taking advantage of weak password requirements or flawed password handling, the attacker bypasses the intended authentication control and obtains access to the MLflow application. After gaining access, the attacker can enumerate experiments, runs, registered models, artifacts, users, and configuration data. Depending on the deployment and authorization model, the attacker may download sensitive artifacts, alter experiment results, register or replace models, delete data, or pivot using exposed credentials, object-storage paths, tokens, or pipeline references found in MLflow metadata.

How to fix it

Upgrade MLflow to a version that includes commit 1f74f3f24d8273927b8db392c23e108576936c54 or later. If consuming MLflow from source, rebuild and redeploy from a commit at or after that fixed revision. If using a downstream package or vendor distribution, apply the vendor-provided update that incorporates the MLflow fix. The supplied affected-product data also references a Red Hat OpenShift Jenkins package fixed in 0:2.176.2.1563461785-1.el7; validate whether that package is actually present and applicable in the environment before treating it as in scope. As compensating controls until upgrade is complete, restrict MLflow access to trusted networks or VPNs, place it behind a strong external identity provider or reverse proxy with MFA, disable public exposure, rotate MLflow-related credentials, enforce strong password policy outside the application where possible, and review authorization settings for least privilege.

How to confirm the fix worked

Confirm the deployed MLflow code or package contains commit 1f74f3f24d8273927b8db392c23e108576936c54 or a later vendor release that includes it. Record the MLflow version, container image digest, package build, or Git commit for each deployed instance. Test from an unauthenticated session that protected MLflow resources, API routes, model registry actions, artifact access, and administrative functions require valid authentication and cannot be reached through weak or malformed password flows. Verify network controls block direct unauthenticated access from untrusted networks. For source deployments, compare the running image or checkout against the fixed commit rather than relying only on a displayed version string. For downstream vendor packages, verify the installed package version matches or exceeds the documented fixed package, such as Red Hat Jenkins package 0:2.176.2.1563461785-1.el7 only where applicable.

Typical attack path

1. Discover an exposed MLflow tracking server or affected MLflow-based service through scanning, search engines, asset inventories, or internal reconnaissance.
2. Confirm the service is running an affected MLflow build or commit prior to the fixed revision.
3. Interact with authentication or password-handling endpoints without valid credentials.
4. Exploit the weak password validation behavior to bypass authentication or obtain an authenticated session.
5. Enumerate MLflow experiments, runs, registered models, artifacts, users, and configuration metadata.
6. Download sensitive model artifacts, parameters, datasets references, or credentials exposed through run metadata or artifact storage configuration.
7. Modify, register, replace, or delete model artifacts or experiment records where application permissions allow.
8. Use any recovered secrets or infrastructure references to pivot to object storage, CI/CD systems, model-serving infrastructure, or adjacent ML platforms.

How to detect it

Review MLflow application logs, reverse-proxy logs, ingress-controller logs, web access logs, container stdout/stderr, identity-provider logs if fronted by SSO, and infrastructure flow logs for evidence of unauthenticated or suspicious access to MLflow. Focus on requests to authentication, user, experiment, model registry, and artifact endpoints from unfamiliar IP addresses, unexpected geographies, scanners, or automation user agents. Look for successful access to protected API routes without a preceding legitimate login event, repeated login or password-related requests followed by experiment or artifact enumeration, and access from IPs that had not previously used the service. Review MLflow database and artifact store metadata for unexpected users, sessions, experiments, model versions, registered models, deleted runs, changed tags, changed artifact paths, or anomalous downloads. If object storage backs MLflow artifacts, inspect storage access logs for bulk reads, unusual object listing, or access from identities normally only used by MLflow. Because no public exploitation pattern or known threat actor is provided, detection should be behavior-based rather than tied to a single payload string.

• GET /api/2.0/mlflow/experiments/list
• GET /api/2.0/mlflow/experiments/search
• GET /api/2.0/mlflow/runs/search
• GET /api/2.0/mlflow/registered-models/search
• GET /api/2.0/mlflow/model-versions/search
• GET /api/2.0/mlflow/artifacts/list
• GET /api/2.0/mlflow/artifacts/download
• POST /api/2.0/mlflow/experiments/create
• POST /api/2.0/mlflow/runs/create
• POST /api/2.0/mlflow/registered-models/create
• POST /api/2.0/mlflow/model-versions/create
• POST /api/2.0/mlflow/runs/delete
• POST /api/2.0/mlflow/experiments/delete
• POST /api/2.0/mlflow/registered-models/delete
• /ajax-api/2.0/mlflow/experiments/search
• /ajax-api/2.0/mlflow/runs/search
• /ajax-api/2.0/mlflow/registered-models/search
• /ajax-api/2.0/mlflow/artifacts/list
• /ajax-api/2.0/mlflow/artifacts/download
• mlflow server
• mlflow ui

What your security team should do

• Inventory all MLflow tracking servers, model registries, containers, notebooks, and ML platforms that embed MLflow, prioritizing internet-facing and multi-user deployments.
• Patch or rebuild MLflow deployments to include commit 1f74f3f24d8273927b8db392c23e108576936c54 or later.
• Immediately restrict external access to MLflow services until patching is complete, using firewall rules, private networking, VPN, or a reverse proxy with strong identity controls.
• Review MLflow access logs for unauthenticated access attempts, unusual login activity, new sessions, and unexpected API calls before and after patching.
• Rotate passwords, API tokens, object-storage keys, service-account credentials, and CI/CD secrets that may have been stored in MLflow metadata or artifacts.
• Audit MLflow experiments, registered models, model versions, artifacts, and run metadata for unauthorized creation, deletion, replacement, or tampering.
• Add monitoring for MLflow authentication routes and sensitive API routes, especially requests from unknown IP addresses or user agents.
• Do not rely solely on the currently low EPSS score; treat exposed MLflow instances as high priority because the vulnerability is remotely exploitable without authentication and has critical severity.