MLflowGHSA-67c5-x5mf-rppq
MLflow: origin validation error
Critical9.6CVE-2026-2611 · Published May 19, 2026 · updated Jun 29, 2026
In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow Assistant running on a victim's local machine. By bypassing the loopback-only restriction, the attacker can modify the Assistant's configuration to enable full access, which in turn allows the execution of arbitrary commands via the Claude Code sub-agent. This issue is resolved in version 3.10.0.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| mlflow PyPI | >= 3.9.0, < 3.10.0 | 3.10.0 |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-346
- Also known as
- BIT-mlflow-2026-2611, CVE-2026-2611, PYSEC-2026-418
More MLflow advisories
All MLflow| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| May 26 | MLflow allows unauthorized access to multipart upload endpoints when the `--serve-artifacts` mode is enabled Critical9.0May 26 | Critical9.0 | 3.11.0rc1 |
| May 21 | MLflow: information disclosureMedium6.5May 21 | Medium6.5 | 3.10.0 |
| May 18 | MLFlow Creates a Temporary File With Insecure PermissionsHigh7.0May 18 | High7.0 | 3.11.0 |
| May 15 | MLflow: unauthenticated access to certain FastAPI routesHigh8.6May 15 | High8.6 | 3.11.0 |
| May 11 | MLflow allows an unauthenticated remote attacker to read arbitrary files from the server's filesystemHigh7.5May 11 | High7.5 | 3.10.0 |
| May 11 | MLflow Has a Server-Side Request Forgery (SSRF) VulnerabilityHigh7.1May 11 | High7.1 | 3.9.0 |