CVE-2026-2611
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk29th percentile — higher than 29% of all known CVEs
Summary
In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow Assistant running on a victim's local machine.
Risk Assessment
An attacker can bypass the loopback-only restriction, modify the Assistant's configuration to enable full access, and then execute arbitrary commands via the Claude Code sub-agent, leading to system compromise.
Recommendation
Immediately upgrade MLflow to version 3.10.0 or later, which fixes this vulnerability. Until then, restrict access to the MLflow interface to trusted networks only.
Original NVD description (English source)
In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow Assistant running on a victim's local machine. By bypassing the loopback-only restriction, the attacker can modify the Assistant's configuration to enable full access, which in turn allows the execution of arbitrary commands via the Claude Code sub-agent. This issue is resolved in version 3.10.0.