MLflow CVE-2026-2611

The victim must be running MLflow 3.9.0 (or another affected 3.x build) with the MLflow Assistant feature enabled and the Claude Code sub-agent integration active, with the server reachable on loopback (default mlflow server behavior). The victim must also visit or be redirected to an attacker-controlled webpage in the same browser session - the CVSS UI:R requirement is genuine. Limiting factors: no exploitation against a host that is not concurrently running the MLflow server; environments that disable the Assistant, restrict the server to a non-browser-reachable interface, or front it with a proxy enforcing strict Origin validation are not exploitable. No credentials are required (PR:N), and Scope:Changed reflects the pivot from the browser sandbox to OS-level command execution.

The CVSS 3.0 score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) reflects a network-reachable, low-complexity, unauthenticated attack that requires user interaction (visiting a malicious page) and crosses a trust boundary (Scope:Changed) to compromise the host running MLflow. This is consistent with classic browser-pivot CSRF-to-RCE chains against localhost services. No EPSS, KEV, or SSVC data was provided, and no public exploit code was identified at time of analysis - but the huntr.com bounty disclosure and the public commit diff give would-be attackers a clear roadmap, so real-world risk should be treated as elevated for any user who runs mlflow server locally with the Assistant enabled while browsing the web. One caveat: the CVSS vector lists AV:N, but actual exploitation requires the victim's browser to reach an MLflow instance the attacker cannot directly contact, so 'network' here means 'via the victim's browser session' rather than direct internet exposure - defenders should not assume an internet-facing MLflow Assistant is a precondition.

A data scientist runs mlflow server locally with the Assistant enabled and, in another browser tab, visits an attacker-controlled page. That page issues cross-origin POSTs to http://127.0.0.1:5000/ajax-api/... which - because the wildcard CORS policy and missing /ajax-api/ path check let the request through - flip the Assistant into full-access mode and then submit a prompt to the Claude Code sub-agent that executes arbitrary shell commands on the developer's workstation. No public PoC was identified at time of analysis, but the upstream patch diff effectively documents the bypass path.