mlflow Password Requirement Vulnerability in User Account Creation

A vulnerability exists in mlflow version 2.18, allowing administrators to create user accounts without setting a password. This oversight could lead to unauthorized access, as passwordless accounts may be easily exploited. Furthermore, the issue contravenes established best practices for secure user account management. The vulnerability has been addressed in version 2.19.0.

Impact

The absence of password requirements can result in unauthorized access to user accounts, creating potential security risks. Additionally, this vulnerability raises compliance issues by violating standard practices for secure account management.

Reproduction

To reproduce this vulnerability, log in as an admin and navigate to the signup page. Fill in the required fields, such as username, but leave the password field blank. Submit the form to create the user account without a password.

Remediation

Users can update to mlflow version 2.19.0 or later, where this vulnerability has been fixed.