CVE-2026-2611: MLflow: Improper Origin Validation in MLflow Assistant /ajax-api Endpoints Enables Browser-Mediated Local Command Execution
(updated )
In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow Assistant running on a victim’s local machine. By bypassing the loopback-only restriction, the attacker can modify the Assistant’s configuration to enable full access, which in turn allows the execution of arbitrary commands via the Claude Code sub-agent. This issue is resolved in version 3.10.0.
References
- access.redhat.com/security/cve/CVE-2026-2611
- bugzilla.redhat.com/show_bug.cgi?id=2479797
- github.com/advisories/GHSA-67c5-x5mf-rppq
- github.com/mlflow/mlflow
- github.com/mlflow/mlflow/commit/8f9c8a53af90842944101eb8b7d60706822c81bc
- github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2026-418.yaml
- huntr.com/bounties/8462addd-b464-4a84-b6a2-5529604e6e5a
- nvd.nist.gov/vuln/detail/CVE-2026-2611
- pypi.org/project/mlflow
Code Behaviors & Features
Detect and mitigate CVE-2026-2611 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →