MLflow CVE-2025-11200

Exploitation requires an MLflow server running the built-in basic authentication module (mlflow/server/auth) AND a target account protected by a weak or default password - specifically the shipped default admin credential 'password' or any short password of 4+ characters that the pre-patch policy allowed. The limiting factors that reduce real-world risk: MLflow's basic auth must be explicitly enabled and reachable by the attacker, and the attack fails entirely if operators changed the default admin credential to a strong password, since the underlying check is credential guessing/brute force rather than a true authentication-logic bypass. Networks that front MLflow with an external IdP or reverse-proxy auth are not exposed via this weakness.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) rates this as critical, network-reachable, unauthenticated, low-complexity with total C/I/A impact. However, the assigned CWE-521 (Weak Password Requirements) and the vendor patch tell a more nuanced story that conflicts with that score: the commit raises the signup minimum password length from 4 to 12 characters, adds server-side password validation, and changes the shipped default admin_password from 'password' to 'password1234'. This is a weak-default/weak-policy issue enabling password guessing and brute force, NOT a logic flaw that bypasses the authentication check entirely - so the 'authentication is not required' framing and AC:L are arguably overstated, since exploitation in practice depends on the target actually running a weak or default credential. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no positive signal of active or at-scale exploitation to corroborate the 9.8. Net assessment: a genuine high-priority hardening issue for any MLflow deployment that enabled basic auth and never changed the default credentials, but the real-world risk is gated by configuration rather than being universally exploitable as the raw CVSS implies - verify whether affected servers use default/short passwords before treating this as a confirmed critical.

An attacker discovers an internet- or network-reachable MLflow tracking server with basic authentication enabled and attempts the shipped default credentials (admin / 'password') or brute-forces a short 4+ character password permitted by the pre-patch policy. On success they gain administrative access to the MLflow instance, exposing models, experiment data, and registry operations. No public exploit code is identified in the provided data, so the scenario relies on credential guessing rather than a published tool.