GHSA-969w-gqqr-g6j3MediumCVSS 5.4

MLflow Cross-Site Request Forgery (CSRF) vulnerability

Published
March 20, 2025
Last Modified
August 5, 2025

🔗 CVE IDs covered (1)

CVE-2025-1473 →

📋 Description

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Signup feature of mlflow/mlflow versions 2.17.0 to 2.20.1. This vulnerability allows an attacker to create a new account, which may be used to perform unauthorized actions on behalf of the malicious user.

🎯 Affected products1

  • pip/mlflow:>= 2.17.0, < 2.20.3

🔗 References (4)