PT-2025-7512 · Mlflow · Mlflow

Published 2025-02-20 · Updated 2025-08-06 · CVE-2025-1473

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions mlflow/mlflow versions 2.17.0 through 2.20.1

Description A Cross-Site Request Forgery (CSRF) issue exists in the Signup feature. This allows an attacker to create a new account, which can be used to perform unauthorized actions on behalf of the malicious user.

Recommendations For mlflow/mlflow versions 2.17.0 through 2.20.1, consider disabling the Signup feature until a patch is available to prevent unauthorized account creation. Restrict access to the vulnerable Signup feature to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BIT-MLFLOW-2025-1473

CVE-2025-1473

GHSA-969W-GQQR-G6J3

Affected Products

Mlflow

References · 13

• 🔥 https://huntr.com/bounties/43dc50b6-7d1e-41b9-9f97-f28809df1d45 · Exploit
• https://github.com/mlflow/mlflow/commit/ecfa61cb43d3303589f3b5834fd95991c9706628 · Patch
• https://osv.dev/vulnerability/CVE-2025-1473 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-1473 · Security Note
• https://osv.dev/vulnerability/GHSA-969w-gqqr-g6j3 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mlflow-2025-1473 · Vendor Advisory
• https://github.com/mlflow/mlflow · Note
• https://t.me/cveNotify/130959 · Telegram Post
• https://twitter.com/CVEnew/status/1902671130210504964 · Twitter Post
• https://twitter.com/defhawk_specter/status/1892446111199350938 · Twitter Post
• https://t.me/cvedetector/20714 · Telegram Post
• https://t.me/cvetracker/19528 · Telegram Post
• https://twitter.com/krishnast54/status/1892570844674617584 · Twitter Post