EUVD-2026-71119
GHSA-5h56-hf5q-phrw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Aim tracking server port
-
DeliveryRegister client unauthenticated
-
ExploitInstantiate Repo resource
-
ExecutionDispatch arbitrary method via getattr
-
ImpactRead experiments or delete runs / execute code
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network reachability to Aim 3.29.1's remote tracking server (the transport RPC endpoint in aim/ext/transport/server.py); the server must be running in remote-tracking mode and be reachable by the attacker. No authentication, credentials, or user interaction are needed - the getattr method dispatch has no allowlist and the transport performs no auth (PR:N/UI:N/AC:L). The primary limiting factor is exposure: Aim remote tracking is an opt-in feature, so instances bound only to localhost or a private/firewalled interface are not remotely exploitable. No specific client platform is required. |
| Impact | This is a genuine high priority where the tracking server is network-reachable. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, base 9.3) reflects unauthenticated network exploitation of default remote-tracking deployments with high confidentiality, integrity and availability impact - consistent with the CWE-306 root cause and the described ability to read experiments and delete runs. VulnCheck (a credible source, also the reporter) escalates impact to full RCE via the arbitrary method dispatch, which if accurate justifies the C/I/A:H ratings even beyond the read/delete framing in the CVE description. No EPSS score, KEV listing, or public PoC is provided in the input, so exploitation is not confirmed as active or automated in the wild - the main limiting factor is exposure: Aim's remote tracking server is opt-in and often bound to internal or localhost interfaces, so real-world risk concentrates on teams that expose it on shared/ML networks. The description (read/delete) and the VulnCheck advisory title (RCE) diverge in stated impact; treat RCE as vendor-claimed pending independent confirmation of the code-execution path. |
| Exploit ScenarioDerived | An attacker who can reach the Aim tracking server port (e.g., an ML server exposed on a corporate or cloud network) connects without credentials, registers a client, and instantiates a Repo resource. Using the unguarded getattr dispatch they invoke methods to exfiltrate experiment data or delete runs, and per VulnCheck can chain the arbitrary method calls into remote code execution on the host. Low attack complexity and no authentication make this trivial to automate once the endpoint is discovered. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 04, 2026
Unauthenticated remote method dispatch in the Aim 3.29.1 ML experiment-tracking server lets attackers reach the tracking RPC endpoint without any credentials and invoke arbitrary methods via an unguarded getattr call. Because there is no allowlist, an attacker can register a client, instantiate Repo resources, and call methods that read experiment data or delete runs; VulnCheck's advisory frames the same dispatch primitive as achieving full remote code execution. No public exploit is identified at time of analysis, though VulnCheck has published a detailed advisory describing the attack.
RemediationAI
No vendor-released patched version is identified at time of analysis - the input references a GitHub issue (aimhubio/aim#3412) and a VulnCheck advisory but no tagged fixed release, so upstream fix status is unconfirmed; monitor https://github.com/aimhubio/aim/issues/3412 and the VulnCheck advisory for a patched version. As compensating controls, do not expose the Aim remote tracking server to untrusted networks: bind it to localhost or a private interface and block its port at the firewall so only trusted hosts can reach it (trade-off: breaks legitimate remote clients, requiring a VPN or SSH tunnel). Where remote access is required, place the server behind an authenticating reverse proxy or mTLS gateway and restrict source IPs to known ML infrastructure (trade-off: added operational complexity and no protection if an attacker is already on the trusted segment). Treat any exposed 3.29.1 instance as potentially compromised and audit for deleted or altered runs.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Aim (CPE cpe:2.3:a:aimhubio:aim) is a popular open-source experiment tracking and metadata store for ML workflows. Its remote tracking mode exposes a server (aim/ext/transport/server.py and tracking.py at tag v3.29.1) that accepts RPC requests and resolves the requested operation by dynamically looking up attributes/methods on server-side resource objects with Python's getattr. The root cause is CWE-306 (Missing Authentication for a Critical Function): the transport layer performs no request authentication and applies no allowlist to the getattr-based dispatch, so any exposed method on a resource - including Repo instantiation and run mutation - becomes callable by any client that can reach the port.
Know when Aim gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Unauthenticated network dispatch with no allowlist yields C/I/A:H (data read, run deletion, and vendor-claimed RCE); scope unchanged as impact stays on the tracking host.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods through getattr without allowlist validation. Unauthenticated attackers can register clients, instantiate Repo resources, and invoke arbitrary methods to read experiments or delete runs.
Executive ViewAI
Aim machine learning experiment-tracking platform (versions through 3.29.1) exposes a critical unauthenticated API endpoint that enables remote attackers to access confidential experimental data, delete research runs, and potentially achieve full system compromise without credentials. Organizations using Aim face exposure of proprietary models, training datasets, and research findings, combined with infrastructure takeover risk. Immediate network isolation is required pending vendor remediation.
No vendor-released patch identified at time of analysis. Implement network isolation by restricting RPC endpoint access to internal networks via firewall rules and disabling any public exposure. Deploy API gateway or WAF with mandatory authentication (API key, JWT, or OAuth2) enforced on all method dispatch requests. Implement IP allowlisting for permitted client connections. Monitor server access logs for suspicious method invocation patterns (unguarded getattr calls, unexpected Repo instantiation, client registration attempts) and audit Aim configuration weekly pending vendor remediation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
A vulnerability in the `_backup_run` function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any fi
A critical Remote Code Execution (RCE) vulnerability was identified in the aimhubio/aim project, specifically within the
A vulnerability in aimhubio/aim version 3.19.3 allows an attacker to exploit the `tarfile.extractall()` function to extr
aimhubio/aim is vulnerable to Cross-Site Request Forgery (CSRF), allowing attackers to perform actions such as deleting
Aim is an open-source, self-hosted machine learning experiment tracking tool. Rated high severity (CVSS 8.6), this vulne
In version 3.22.0 of aimhubio/aim, the AimQL query language uses an outdated version of the safer_getattr() function fro
In version 3.22.0 of aimhubio/aim, the LocalFileManager._cleanup function in the aim tracking server accepts a user-spec
In version 3.23.0 of aimhubio/aim, the ScheduledStatusReporter object can be instantiated to run on the main thread of t
In version 3.25.0 of aimhubio/aim, a denial of service vulnerability exists. Rated high severity (CVSS 7.5), this vulner
A vulnerability in aimhubio/aim version 3.25.0 allows for a denial of service (DoS) attack. Rated high severity (CVSS 7.
In version 3.23.0 of aimhubio/aim, certain methods that request data from external servers do not have set timeouts, cau
A vulnerability in aimhubio/aim version 3.19.3 allows an attacker to cause an infinite loop by configuring the remote tr
Exploit-DB