Free AI Safety Workshop — in collaboration with explainx.aiSave your seat
AgentbeamBeta
AI agent vulnerability · MLflow

CVE-2025-11200: MLflow Weak Password Requirements Authentication Bypass Vulnerability

highCVSS 3.0 8.1GHSA-6xj8-rrqx-r4cv

MLflow Weak Password Requirements Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of passwords. The issue results from weak password requirements.

Published Oct 29, 2025 · Updated Nov 5, 2025

Affected packages

mlflow

Ecosystem
PyPI
Affected
< 2.22.0rc0
Fixed in
2.22.0rc0
Check
pip show mlflow

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

MLflow Weak Password Requirements Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of passwords. The issue results from weak password requirements. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26916.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More MLflow vulnerabilities

All MLflow entries