All vulnerabilities
CVE-2026-2611BIT-mlflow-2026-2611GHSA-67c5-x5mf-rppqPYSEC-2026-418

MLflow: Improper Origin Validation in MLflow Assistant /ajax-api Endpoints Enables Browser-Mediated Local Command Execution

mlflow mlflowpipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
9.6Critical
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 19 May 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.41%Chance of exploitation activity in the next 30 days, higher than 34% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.10.0Fixed versionGitHub
Published19 May 2026Updated 5 Oct 2026CVE List

What fixes it

  • 3.10.0mlflow, pipGitHub
  • 3.10.0mlflow/mlflowCVE List
  • 3.10.0mlflow, PyPIOSVpip install "mlflow>=3.10.0"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow Assistant running on a victim's local machine. By bypassing the loopback-only restriction, the attacker can modify the Assistant's configuration to enable full access, which in turn allows the execution of arbitrary commands via the Claude Code sub-agent. This issue is resolved in version 3.10.0.

Text from CVE List

Affected versions 5

  • mlflow, pip= 3.9.0GitHub
  • mlflow/mlflowaffected: unspecified before 3.10.0CVE List
  • mlflow, PyPIfrom 3.9.0, fixed in 3.10.0OSV
  • mlflow, PyPI3.10.0rc0OSV
  • mlflow, PyPI3.9.0OSV

References 10