CVE-2025-1473

Name of the Vulnerable Software and Affected Versions mlflow/mlflow versions 2.17.0 through 2.20.1

Description A Cross-Site Request Forgery (CSRF) issue exists in the Signup feature. This allows an attacker to create a new account, which can be used to perform unauthorized actions on behalf of the malicious user.

Recommendations For mlflow/mlflow versions 2.17.0 through 2.20.1, consider disabling the Signup feature until a patch is available to prevent unauthorized account creation. Restrict access to the vulnerable Signup feature to minimize the risk of exploitation.