CVE-2025-11200
criticalpriority · track · 40EPSS 0.014 · 73 %ileEUUSEPSS · scored 2026-10-26
MLflow Weak Password Requirements Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of passwords. The issue results from weak password requirements. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26916.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 8.1–9.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (4)
Products and version ranges known to be affected.
advisories (3)
Vendor and ecosystem advisories describing this.
- GHSA-6xj8-rrqx-r4cvMLflow Weak Password Requirements Authentication Bypass Vulnerability2025-10-29ghsa · osvUS
MLflow Weak Password Requirements Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of passwords. The issue results from weak password requirements. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26916.
- BIT-mlflow-2025-11200MLflow Weak Password Requirements Authentication Bypass Vulnerability2025-11-06vendor · osvUS
MLflow Weak Password Requirements Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of passwords. The issue results from weak password requirements. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26916.
- PYSEC-2026-1642MLflow Weak Password Requirements Authentication Bypass Vulnerability2026-07-07vendor · osvUS
MLflow Weak Password Requirements Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of passwords. The issue results from weak password requirements. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26916.
also known as (7)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (6)
External citations — patches, advisories, analysis.
- https://github.com/mlflow/mlflow/commit/1f74f3f24d8273927b8db392c23e108576936c54cnnvd
- https://www.zerodayinitiative.com/advisories/ZDI-25-932/cnnvd
- https://github.com/mlflow/mlflow/commit/1f74f3f24d8273927b8db392c23e108576936c54enisa_euvd
- https://www.zerodayinitiative.com/advisories/ZDI-25-932/enisa_euvd
- https://github.com/mlflow/mlflow/commit/1f74f3f24d8273927b8db392c23e108576936c54Patchnvd
- https://www.zerodayinitiative.com/advisories/ZDI-25-932/Third Party Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan