Weak Password Requirements

Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Weak Password Requirements due to the lack of enforcement on...

argosml (>=0.0.1, <=0.1.3), auf (>=1.0.0, <=2.0.1) +86 more potentially affected by CVE-2025-1474 via mlflow (>=2.0.0rc0, <=2.18.0)

mlflow PYPI version =2.0.0rc0, =0.0.1, =1.0.0, =1.0.1, =0.1.0, =0.0.4, =0.1.3, =0.1.2, =1.2.0, =0.8.0, =0.0.10, =0.0.1, =0.1.11 and more Source cves: CVE-2025-1474 Source advisory: SNYK:PYTHON-MLFLOW-9486737...

api-python-bet-project (>=0.1.9, <=0.1.22), argosml (>=0.0.1, <=0.1.3) +97 more potentially affected by CVE-2025-1473 via mlflow (>=2.0.0rc0, <=2.20.1)

mlflow PYPI version =2.0.0rc0, =0.1.9, =0.0.1, =1.0.0, =1.0.4, =1.0.1, =0.1.0, =0.0.4, =0.1.3, =0.1.2, =1.2.0, =0.8.0, =0.10.0 and more Source cves: CVE-2025-1473 Source advisory: SNYK:PYTHON-MLFLOW-9486736...

Cross-site Request Forgery (CSRF)

Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF through the Signup feature. An...

GHSA-969W-GQQR-G6J3 MLflow Cross-Site Request Forgery (CSRF) vulnerability

A Cross-Site Request Forgery CSRF vulnerability exists in the Signup feature of mlflow/mlflow versions 2.17.0 to 2.20.1. This vulnerability allows an attacker to create a new account, which may be used to perform unauthorized actions on behalf of the malicious user...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2025-1474 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2025-1474 Source advisory: OSV:GHSA-4RJ2-9GCX-5QHX...

deepsleep (1.0.3) potentially affected by CVE-2025-1474 via mlflow (1.5.0)

mlflow PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - deepsleep 1.0.3 Source cves: CVE-2025-1474 Source advisory: OSV:GHSA-4RJ2-9GCX-5QHX...

MLflow has Weak Password Requirements

In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user accou...

nerblackbox (>=0.0.11, <=0.0.13), qacaller (>=0.0.1, <=0.1.2) potentially affected by CVE-2025-1474 via mlflow (1.8.0)

mlflow PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - nerblackbox =0.0.11, =0.0.1, =0.1.2 Source cves: CVE-2025-1474 Source advisory: OSV:GHSA-4RJ2-9GCX-5QHX...

dagster-mlflow (>=0.18.0, <=0.18.3), dbx (0.5.0) +13 more potentially affected by CVE-2025-1474 via mlflow (1.26.1)

mlflow PYPI version 1.26.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - dagster-mlflow =0.18.0, =0.2.5, =0.0.1, =0.3.3, =0.2.0.dev3, =0.2.0.dev2, =0.40.2.dev25, =0.40.2.dev18, =0.39.1rc2, =3.2.7, =0.0.1, =0.1.2, =0.2.1...

api-python-bet-project (>=0.1.9, <=0.1.22), argosml (>=0.0.1, <=0.1.3) +24 more potentially affected by CVE-2025-1473 via mlflow (>=2.17.0, <=2.20.2)

mlflow PYPI version =2.17.0, =0.1.9, =0.0.1, =1.0.6, =1.1.5, =1.6.0, =0.14.0, =0.14.0, =0.14.0, =0.1.1, =0.15.0, =1.4.4, =1.11.2 - mlflow-cors 0.1.1 - mlflow-dep-analyzer 0.7.0 and more Source cves: CVE-2025-1473 Source advisory: GHSA-969W-GQQR-G6J3...

hip-data-ml-utils (>=0.3.7, <=1.0.0), mllibprodest (>=1.5.0, <=1.5.1) +1 more potentially affected by CVE-2025-1474 via mlflow (1.29.0)

mlflow PYPI version 1.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - hip-data-ml-utils =0.3.7, =1.5.0, =0.2.33, =0.2.39 Source cves: CVE-2025-1474 Source advisory: OSV:GHSA-4RJ2-9GCX-5QHX...

dagster-mlflow (>=0.14.18rc5, <=0.17.21), sparkpipelineframework (1.0.18) potentially affected by CVE-2025-1474 via mlflow (1.26.0)

mlflow PYPI version 1.26.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - dagster-mlflow =0.14.18rc5, =0.17.21 - sparkpipelineframework 1.0.18 Source cves: CVE-2025-1474 Source advisory: OSV:GHSA-4RJ2-9GCX-5QHX...

flown (>=0.0.1, <=0.1.0) potentially affected by CVE-2025-1474 via mlflow (1.17.0)

mlflow PYPI version 1.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - flown =0.0.1, =0.1.0 Source cves: CVE-2025-1474 Source advisory: OSV:GHSA-4RJ2-9GCX-5QHX...

dagster-mlflow (>=0.19.11, <=0.21.4), databricks-session (0.1.9) +14 more potentially affected by CVE-2025-1474 via mlflow (1.27.0)

mlflow PYPI version 1.27.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - dagster-mlflow =0.19.11, =0.3.0, =0.0.4.dev3, =3.0.1, =4.0.2, =0.1.0, =3.2.18, =0.1.0, =0.0.1.dev202206240024, =0.1.0, =0.1.5 and more Source cves:...

azureml-contrib-run (>=1.0.18.2, <=1.0.21.1) potentially affected by CVE-2025-1474 via mlflow (0.8.2)

mlflow PYPI version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-contrib-run =1.0.18.2, =1.0.21.1 Source cves: CVE-2025-1474 Source advisory: OSV:GHSA-4RJ2-9GCX-5QHX...

azureml-contrib-run (>=1.0.23, <=1.0.30.1) potentially affected by CVE-2025-1474 via mlflow (0.9.0)

mlflow PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-contrib-run =1.0.23, =1.0.30.1 Source cves: CVE-2025-1474 Source advisory: OSV:GHSA-4RJ2-9GCX-5QHX...

openstef (>=3.2.0a0, <=3.2.6) potentially affected by CVE-2025-1474 via mlflow (1.25.1)

mlflow PYPI version 1.25.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - openstef =3.2.0a0, =3.2.6 Source cves: CVE-2025-1474 Source advisory: OSV:GHSA-4RJ2-9GCX-5QHX...

autorad (0.1.2), merlin-sdk (>=0.19.0rc1, <=0.34.1) +2 more potentially affected by CVE-2025-1474 via mlflow (1.23.0)

mlflow PYPI version 1.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - autorad 0.1.2 - merlin-sdk =0.19.0rc1, =0.7.2rc1, =0.12.0 Source cves: CVE-2025-1474 Source advisory: OSV:GHSA-4RJ2-9GCX-5QHX...

autorad (>=0.2.2, <=0.2.5), katonic (>=1.3.0, <=1.6.0) potentially affected by CVE-2025-1474 via mlflow (1.23.1)

mlflow PYPI version 1.23.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - autorad =0.2.2, =1.3.0, =1.6.0 Source cves: CVE-2025-1474 Source advisory: OSV:GHSA-4RJ2-9GCX-5QHX...