MLflow Assistant: missing origin validation lets a web page drive the local Assistant into command execution

CVSS 9.6CVE-2026-2611AI/ML frameworks & servingcurated

Impact

MLflow 3.9.0's Assistant feature does not validate request origin on its /ajax-api endpoints, so a malicious web page a user visits can issue cross-origin requests to the Assistant bound on their loopback interface. The attacker flips the Assistant configuration to full access and then runs arbitrary commands through its sub-agent, with the privileges of whoever launched MLflow. On an ML platform that usually means the account that reaches the tracking store, artifact buckets and registered models, so a browser visit turns into code execution on a machine inside the training environment. Exposure is limited to installs running the 3.9.0 Assistant; the loopback binding is not a boundary here.

Who can reach it

Remote, unauthenticated web page plus one visit by a user whose machine runs the MLflow Assistant. No credentials for MLflow are needed; the victim's browser supplies the reach.

What to do

Upgrade MLflow to 3.10.0 and restart the MLflow process. Red Hat tracks the same issue for OpenShift AI (RHOAI); follow their VEX for shipped-version status. Until upgraded, do not run the 3.9.0 Assistant on machines used for general browsing.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-2611 https://github.com/mlflow/mlflow/commit/8f9c8a53af90842944101eb8b7d60706822c81bc https://access.redhat.com/security/cve/CVE-2026-2611 https://huntr.com/bounties/8462addd-b464-4a84-b6a2-5529604e6e5a

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.