{"data":{"id":"6baf45a0-98a5-4b15-aac4-39ab8109cd71","title":"CVE-2025-11200: MLflow Weak Password Requirements Authentication Bypass Vulnerability. This vulnerability allows remote attackers to…","summary":"CVE-2025-11200 is an authentication bypass in MLflow, tracked by ZDI as ZDI-CAN-26916. The flaw stems from weak password requirements in the handling of passwords, and remote attackers can exploit it without authentication to bypass login on affected installations. NVD has not yet provided an assessment.","solution":"The source links a commit to the MLflow GitHub repository (https://github.com/mlflow/mlflow/commit/1f74f3f24d8273927b8db392c23e108576936c54) and a ZDI advisory (https://www.zerodayinitiative.com/advisories/ZDI-25-932/), but does not state a fix, fixed version, or workaround in the text.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-11200","publishedAt":"2025-10-30T00:15:35.543Z","cveId":"CVE-2025-11200","cweIds":["CWE-521"],"cvssScore":"9.8","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["mlflow@< 2.22.0rc0 (fixed: 2.22.0rc0)"],"affectedPackageNames":["mlflow"],"affectedPackageRefs":["pypi:mlflow"],"affectedVendors":[],"affectedVendorsRaw":["MLflow"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"MLflow authentication bypass through weak password requirements","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.01439,"epssCheckedAt":"2026-11-04T06:10:15.975Z","kevDateAdded":null,"advisoryAliases":["GHSA-6xj8-rrqx-r4cv"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:52:13.137Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-04-16T13:49:23.350Z","daysToFix":-197,"fixCheckedAt":"2026-10-29T21:43:19.253Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"mlflow","fixedVersion":"2.22.0rc0","matchedVersion":"2.22.0rc0","fixReleasedAt":"2025-04-16T13:49:23.350Z","daysToFix":-197,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:43:19.101Z"}]}}