{"id":"CVE-2026-2611","aliases":["BIT-mlflow-2026-2611","EUVD-2026-30853","GHSA-67c5-x5mf-rppq","PYSEC-2026-418"],"status":"published","title":"Improper Origin Validation in mlflow/mlflow","description":"In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow Assistant running on a victim's local machine. By bypassing the loopback-only restriction, the attacker can modify the Assistant's configuration to enable full access, which in turn allows the execution of arbitrary commands via the Claude Code sub-agent. This issue is resolved in version 3.10.0.","severity":{"version":"3.0","score":9.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00384,"percentile":0.32868,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-346","CWE-940"],"published":"2026-05-19T09:16:42Z","modified":"2026-10-28T02:30:20Z","fixes":[{"ecosystem":"PyPI","package":"mlflow","fixed_in":["3.10.0"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"mlflow","fixed_in":["3.10.0"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"mlflow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.9.0"},{"last_affected":"3.9.0"},{"fixed":"3.10.0"}]}],"versions":["3.9.0"]},{"source":"osv","ecosystem":"Bitnami","package":"mlflow","ranges":[{"type":"SEMVER","events":[{"introduced":"3.9.0"},{"fixed":"3.10.0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"mlflow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.9.0"},{"fixed":"3.10.0"}]}],"versions":["3.10.0rc0","3.9.0"]},{"source":"osv","ecosystem":"PyPI","package":"mlflow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.9.0"},{"fixed":"3.10.0"}]}],"versions":["3.10.0rc0","3.9.0"]}],"products":[{"vendor":"lfprojects","product":"mlflow"},{"vendor":"mlflow","product":"mlflow/mlflow"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"}],"references":[{"url":"https://huntr.com/bounties/8462addd-b464-4a84-b6a2-5529604e6e5a","tags":["exploit","Exploit","Third Party Advisory","advisory","web"]},{"url":"https://github.com/mlflow/mlflow/commit/8f9c8a53af90842944101eb8b7d60706822c81bc","tags":["Patch","fix","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-2611","tags":["vdb-entry","x_refsource_REDHAT","web","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479797","tags":["issue-tracking","x_refsource_REDHAT","web","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2611.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2611","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-67c5-x5mf-rppq","tags":["advisory"]},{"url":"https://github.com/mlflow/mlflow","tags":["package"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2026-418.yaml","tags":["web"]},{"url":"https://pypi.org/project/mlflow","tags":["web","package"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2611.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-2611","title":"Improper Origin Validation in mlflow/mlflow","description":"In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow Assistant running on a victim's local machine. By bypassing the loopback-only restriction, the attacker can modify the Assistant's configuration to enable full access, which in turn allows the execution of arbitrary commands via the Claude Code sub-agent. This issue is resolved in version 3.10.0.","status":"published","published":"2026-05-19T09:16:42.745Z","modified":"2026-07-15T02:49:09.458Z","cvss":[{"version":"3.0","score":9.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"},{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-346","CWE-940"],"updated_at":"2026-11-02T13:48:46.911326Z"}],"euvd":[{"id":"EUVD-2026-30853","description":"In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow Assistant running on a victim's local machine. By bypassing the loopback-only restriction, the attacker can modify the Assistant's configuration to enable full access, which in turn allows the execution of arbitrary commands via the Claude Code sub-agent. This issue is resolved in version 3.10.0.","status":"published","published":"2026-05-19T09:16:42Z","modified":"2026-07-15T02:49:09Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:19:53.678292Z"}],"ghsa":[{"id":"GHSA-67c5-x5mf-rppq","title":"MLflow: Improper Origin Validation in MLflow Assistant /ajax-api Endpoints Enables Browser-Mediated Local Command Execution","description":"In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow Assistant running on a victim's local machine. By bypassing the loopback-only restriction, the attacker can modify the Assistant's configuration to enable full access, which in turn allows the execution of arbitrary commands via the Claude Code sub-agent. This issue is resolved in version 3.10.0.","status":"published","published":"2026-05-19T12:31:37Z","modified":"2026-10-05T21:33:12Z","cvss":[{"version":"3.0","score":9.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-346","CWE-940"],"updated_at":"2026-11-02T14:41:25.889593Z"}],"nvd":[{"id":"CVE-2026-2611","description":"In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow Assistant running on a victim's local machine. By bypassing the loopback-only restriction, the attacker can modify the Assistant's configuration to enable full access, which in turn allows the execution of arbitrary commands via the Claude Code sub-agent. This issue is resolved in version 3.10.0.","status":"published","published":"2026-05-19T10:16:22.983Z","modified":"2026-10-14T20:10:00.19Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.0","score":9.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-346","CWE-940"],"updated_at":"2026-11-02T14:12:19.39893Z"}],"osv":[{"id":"CVE-2026-2611","title":"Improper Origin Validation in mlflow/mlflow","description":"In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow Assistant running on a victim's local machine. By bypassing the loopback-only restriction, the attacker can modify the Assistant's configuration to enable full access, which in turn allows the execution of arbitrary commands via the Claude Code sub-agent. This issue is resolved in version 3.10.0.","status":"published","published":"2026-05-19T09:16:42.745Z","modified":"2026-10-28T02:30:20.924970773Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T15:44:59.80315Z"},{"id":"GHSA-67c5-x5mf-rppq","title":"MLflow: Improper Origin Validation in MLflow Assistant /ajax-api Endpoints Enables Browser-Mediated Local Command Execution","description":"In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow Assistant running on a victim's local machine. By bypassing the loopback-only restriction, the attacker can modify the Assistant's configuration to enable full access, which in turn allows the execution of arbitrary commands via the Claude Code sub-agent. This issue is resolved in version 3.10.0.","status":"published","published":"2026-05-19T12:31:37Z","modified":"2026-10-05T21:45:03.626608223Z","cvss":[{"version":"3.0","score":9.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-346","CWE-940"],"updated_at":"2026-11-02T15:46:39.266402Z"},{"id":"PYSEC-2026-418","title":"MLflow: Improper Origin Validation in MLflow Assistant /ajax-api Endpoints Enables Browser-Mediated Local Command Execution","description":"In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow Assistant running on a victim's local machine. By bypassing the loopback-only restriction, the attacker can modify the Assistant's configuration to enable full access, which in turn allows the execution of arbitrary commands via the Claude Code sub-agent. This issue is resolved in version 3.10.0.","status":"published","published":"2026-06-29T11:50:50.007571Z","modified":"2026-07-01T20:22:58.289747Z","cvss":[{"version":"3.0","score":9.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:57.671918Z"},{"id":"BIT-mlflow-2026-2611","title":"Improper Origin Validation in mlflow/mlflow","description":"In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow Assistant running on a victim's local machine. By bypassing the loopback-only restriction, the attacker can modify the Assistant's configuration to enable full access, which in turn allows the execution of arbitrary commands via the Claude Code sub-agent. This issue is resolved in version 3.10.0.","status":"published","published":"2026-05-29T08:48:33.396Z","modified":"2026-09-08T08:48:13.898428135Z","updated_at":"2026-11-02T15:28:33.072289Z"}]}}