GHSA-6xj8-rrqx-r4cv
High · 8.1CVSS
8.1
EPSS
—
Published
Oct 29, 2025
CISA due date
—
The record
MLflow Weak Password Requirements Authentication Bypass Vulnerability
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | mlflow | 0 | 2.22.0rc0 |
| Bitnami | mlflow | 0 | 2.21.1 |
Related vulnerabilities
- CVE-2025-11200 MLflow Weak Password Requirements Authentication Bypass Vulnerability. Same vulnerability
- CVE-2025-10279 In mlflow version 2.20.3, the temporary directory used for creating Python virtual… Also affects mlflow
- CVE-2025-14279 MLFlow versions up to and including 3.4.0 are vulnerable to DNS rebinding attacks due to… Also affects mlflow
- CVE-2025-11201 MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution… Also affects mlflow
- CVE-2025-52967 gateway_proxy_handler in MLflow before 3.1.0 lacks gateway_path validation. Also affects mlflow
- CVE-2025-0453 MLflow Uncontrolled Resource Consumption vulnerability Also affects mlflow
- CVE-2024-8859 MLflow has a Local File Read/Path Traversal in dbfs Also affects mlflow
- CVE-2024-6838 MLflow Uncontrolled Resource Consumption vulnerability Also affects mlflow