CVE-2025-11200 is a critical (9.8) authentication bypass in MLflow, caused by weak password requirements in its built in authentication. The project has published a fix commit that validates passwords. Confirm the release that includes it, upgrade, and replace any weak or default admin passwords.
What's affected
The record names MLflow, specifically installations that use its built in authentication. It does not list a version range. The fix commit (linked below) adds password validation to user creation and changes the default admin password in the bundled sample configuration.
CVSS 9.8 (critical severity), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The Zero Day Initiative advisory for the same flaw scores it 8.1 with a vector that marks attack complexity as high. Both agree on the cause.
Fixed versions: the ZDI advisory says MLflow has issued an update but links only to the commit. Check the MLflow release notes for the first release that contains it.
How to check if you're exposed
Find your MLflow version and see whether the built in authentication is on.
pip show mlflow
python -c "import mlflow; print(mlflow.__version__)"
If the server is reachable, the documented /version endpoint returns the server version. Then open the auth configuration file used by your server and look at the admin account. If the admin password is still the sample value, or any user has a short password, treat the server as exposed.
For the inventory side, the free in-browser scan at gold.safeguard.sh/scan can list packages from a requirements file and show known issues against them.
What to do now
- Find the first MLflow release that contains the fix commit in the release notes, then upgrade to it or later.
- Reset the admin password and every user password that is short or shared. Do not keep the sample value from the bundled config.
- Do not expose the tracking server directly to the internet. Put it behind a VPN or an authenticating proxy.
- Review the user list for accounts you do not recognise.
- Re-scan your Python environments so you know which hosts still run an older MLflow.
Why it matters
The record classes this as CWE-521 (weak password requirements). The flaw is not a broken check. It is a rule that lets people pick passwords so weak, or leaves a known default admin password in place, that guessing becomes a realistic way in.
An MLflow tracking server holds experiment data, models and credentials for artifact stores. Anyone who gets in can read and change what your data science team trusts. The record does not mark this as on CISA KEV, and the sources do not report attacks.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which MLflow release fixes this?
The advisory links a commit but does not name a release. Check the MLflow release notes for the first release that contains it.
Is a strong password enough?
It closes this flaw but is not the whole control. Keep the server off the open internet and review who has accounts.
Sources
Last reviewed: 19 October 2026.
