{"action":"Upgrade mlflow to 2.19.0 or later.","affected":[{"fixed":"2.19.0","introduced":"0"}],"component":"mlflow","cve_ids":["CVE-2025-1474"],"ecosystem":"PyPI","epss":0.00366,"exploited":false,"fixed_versions":["2.19.0"],"ghsa_id":"GHSA-4rj2-9gcx-5qhx","id":"tcs_01M5KGNZJ4T4JD4R10QFAGMF1X","modified_at":"2026-06-10T17:00:19.264618461Z","published_at":"2025-03-20T10:15:54Z","references":["https://osv.dev/vulnerability/PYSEC-2025-17","https://huntr.com/bounties/e79f7774-10fe-46b2-b522-e73b748e3b2d","https://github.com/mlflow/mlflow/commit/149c9e18aa219bc47e86b432e130e467a36f4a17","https://github.com/advisories/GHSA-4rj2-9gcx-5qhx"],"severity":{"label":"medium","score":5.5},"sources":[{"source":"osv","source_id":"PYSEC-2025-17","url":"https://osv.dev/vulnerability/PYSEC-2025-17"}],"summary":"In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptib"}