CVE-2026-2611
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow Assistant running on a victim's local machine.
Risk Assessment
The risk is that an attacker can bypass the loopback-only restriction, modify the Assistant's configuration to enable full access, and then execute arbitrary commands via the Claude Code sub-agent, potentially leading to full system compromise.
Recommendation
Immediately upgrade MLflow to version 3.10.0 or later, which fixes this vulnerability. Until the update is applied, restrict access to the MLflow interface to trusted networks only.
Original NVD description (English source)
In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow Assistant running on a victim's local machine. By bypassing the loopback-only restriction, the attacker can modify the Assistant's configuration to enable full access, which in turn allows the execution of arbitrary commands via the Claude Code sub-agent. This issue is resolved in version 3.10.0.