MLflow: Improper Origin Validation in MLflow Assistant /ajax-api Endpoints Enables Browser-Mediated…
MLflow
More for MLflow RSS feed for MLflow
- Severity
- Critical, CVSS 9.6
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
- Record
- CVE-2026-2611
- Affects
- MLflow
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- May 19, 2026
- Source last modified
- October 14, 2026
Description
In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow Assistant running on a victim's local machine. By bypassing the loopback-only restriction, the attacker can modify the Assistant's configuration to enable full access, which in turn allows the execution of arbitrary commands via the Claude Code sub-agent. This issue is resolved in version 3.10.0.
Description quoted from the NVD record.
Who is affected
MLflow, made by LF Projects, is a platform that teams use to build, track and manage machine learning (AI) models. This flaw affects version 3.9.0 and sits in the MLflow Assistant feature, when the Assistant is running on a person's own computer. If that person visits a harmful webpage, the page can reach the Assistant even though the Assistant is meant to accept only connections from the same computer. The attacker can then change the Assistant's settings to allow full access and run any commands they choose on that computer through the Claude Code helper the Assistant uses. This flaw is rated Critical.
What to do
- The person who installed or runs MLflow in your organization should act on this. If an IT provider or vendor manages MLflow for you, send them this advisory and ask when the update will be done.
- Find out which version of MLflow is installed on each computer that uses it. Any computer running version
3.9.0is affected. - Update MLflow to version
3.10.0on every affected computer. That version fixes this flaw. - After the update, check again that each computer shows version
3.10.0, so no copy of the affected version is left in use.
Analysis written from the source record as of October 14, 2026 and reviewed before publishing.