Introduction
Unauthorized access to machine learning experiment data and models can lead to data leaks, model theft, or tampering with production pipelines. MLflow, a popular open-source platform for managing the machine learning lifecycle, was recently found to have a critical flaw that lets attackers bypass authentication entirely on some deployments.
About MLflow: MLflow is an open-source platform developed by Databricks for managing the end-to-end machine learning lifecycle. It is widely used in research and enterprise environments, with a large user base and integrations across many ML stacks. It handles experiment tracking, model packaging, deployment, and a model registry, and many data science workflows rely on it as a core component.
Technical information
CVE-2025-11200 is a high-severity authentication bypass vulnerability in MLflow, with a CVSS score of 8.1. The root cause is weak password requirements in the authentication system. MLflow's signup and authentication forms enforced no minimum password length or complexity, so users (or attackers) could create accounts with weak or even empty passwords. That made guessing or brute-forcing credentials trivial for a remote attacker, who could then gain unauthorized access.
The vulnerable logic sat in the authentication module, where password fields lacked proper validation. The official patch (commit 1f74f3f) added a minlength=4 constraint to both the username and password fields in the signup form. Before the patch the form had no such restriction, a classic example of CWE-521 (Weak Password Requirements).
Related issue: CVE-2025-1474, a closely related vulnerability, let administrators create accounts with no password at all. Taken together, the two point to a lack of strong validation in MLflow's authentication mechanisms.
Affected systems and versions
- MLflow versions prior to 2.19.0 are affected.
- The vulnerability affects deployments with basic authentication enabled (via
--app-name basic-auth). - Any configuration that allows user signup or password changes without strong validation is at risk.
Vendor security history
MLflow has had several security issues in recent years, including:
- CVE-2023-6018: Arbitrary file write via artifact path handling
- CVE-2024-2928: Local file inclusion via URI fragment manipulation
- CVE-2025-1474: Account creation without password
Databricks, the primary maintainer, typically issues patches promptly after responsible disclosure. The repeated authentication and input validation flaws, though, suggest ongoing architectural problems in MLflow's security model.
