GHSA-67c5-x5mf-rppq BIT-mlflow-2026-2611 CVE-2026-2611 PYSEC-2026-418
MLflow: Improper Origin Validation in MLflow Assistant /ajax-api Endpoints Enables Browser-Mediated Local Command Execution
- Severity
- 9.6 / 10
- Critical · CVSS 3.0
- Exploit chance (EPSS)
- 0.38%
- Chance of exploitation in the next 30 days. Higher than 32.45% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-346 Origin Validation Error
- CWE-940 Improper Verification of Source of a Communication Channel
- Fix
3.10.0- Upgrade mlflow to this version or later
Description
In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow Assistant running on a victim's local machine. By bypassing the loopback-only restriction, the attacker can modify the Assistant's configuration to enable full access, which in turn allows the execution of arbitrary commands via the Claude Code sub-agent. This issue is resolved in version 3.10.0.
Affected versions
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| mlflow | >= 3.9.0, < 3.10.0 |
3.10.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
mlflow PyPI → 3.10.0
- pip
pip install --upgrade "mlflow>=3.10.0"- poetry
poetry add "mlflow>=3.10.0"- uv
uv add "mlflow>=3.10.0"
Severity breakdown
CVSS 3.0 9.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- Required
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-346: Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
CWE-940: Improper Verification of Source of a Communication Channel
The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.
How to prevent it
- Architecture and Design: Use a mechanism that can validate the identity of the source, such as a certificate, and validate the integrity of data to ensure that it cannot be modified in transit using an Adversary-in-the-Middle (AITM) attack. When designing functionality of actions in the URL scheme, consider whether the action should be accessible to all mobile applications, or if an allowlist of applications to interface with is appropriate.
References
Advisories
Packages
Other links
- github.com/mlflow/mlflow/commit/8f9c8a53af90842944101eb8b7d60706822c81bc
- access.redhat.com/security/cve/CVE-2026-2611
- bugzilla.redhat.com/show_bug.cgi
- github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2026-418.yaml
- huntr.com/bounties/8462addd-b464-4a84-b6a2-5529604e6e5a
- pypi.org/project/mlflow
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2611.json
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-7gwp-5pfp-969j MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding) | Critical Known exploited | Also affects mlflow |
| GHSA-26p8-2jq9-3vq9 MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules | Critical | Also affects mlflow |
| GHSA-j7qq-vr8c-xvw3 MLflow CrewAI autologging records LLM provider API keys in logged trace spans | Medium | Also affects mlflow |
| GHSA-m65p-9j7q-6w33 MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source | High | Also affects mlflow |
| GHSA-2wqp-q3c6-ccj5 MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints | Medium | Also affects mlflow |
| GHSA-wqmh-qccw-pqwf MLflow FileStore trace IDs allow path traversal and arbitrary file writes | High | Also affects mlflow |
| GHSA-gqvg-gmmx-x4hm MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact | High | Also affects mlflow |
| GHSA-h7x2-h6g9-p789 MLflow AI Gateway permits SSRF through an unvalidated api_base | High | Also affects mlflow |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor