PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-2611 mlflow CVE debrief

CVE-2026-2611 is a critical remote attack surface issue in MLflow Assistant where improper origin validation on /ajax-api endpoints can let a malicious webpage interact with the Assistant on a victim’s local machine. According to the published description, this can bypass the intended loopback-only restriction, change Assistant configuration, and lead to arbitrary command execution through the Claude Code sub-agent. The issue is reported as fixed in MLflow 3.10.0.

Vendor
mlflow
Product
mlflow/mlflow
CVSS
CRITICAL 9.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-19
Original CVE updated
2026-07-15
Advisory published
2026-05-19
Advisory updated
2026-07-15

Who should care

MLflow users running version 3.9.0, especially anyone using the MLflow Assistant feature on local workstations. Security teams should prioritize environments where users may browse untrusted websites while the Assistant is active locally.

Technical summary

The reported flaw is an origin-validation failure affecting MLflow Assistant’s /ajax-api endpoints. Because requests from a malicious webpage may be accepted despite the intended loopback-only boundary, a remote attacker can trigger cross-origin interactions against the locally running Assistant process. The described downstream impact is configuration modification that can enable broader access and, in turn, arbitrary command execution via the Claude Code sub-agent. The CVE record maps the weakness to CWE-346 and assigns CVSS 3.0 vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H.

Defensive priority

Immediate / Critical

Recommended defensive actions

  • Upgrade MLflow to version 3.10.0 or later.
  • Treat MLflow Assistant on local machines as exposed to cross-origin abuse until patched.
  • Review whether users can access untrusted websites while the Assistant is running and reduce that exposure where possible.
  • Monitor local MLflow Assistant configuration changes for unexpected updates.
  • Validate that any deployment guidance or hardening intended to enforce loopback-only access remains effective after remediation.

Evidence notes

This debrief is based only on the supplied NVD record, the linked upstream GitHub commit reference, and the Huntr bounty reference. The source data states CVE-2026-2611 was published and modified on 2026-05-19, with MLflow 3.9.0 affected and 3.10.0 containing the fix. NVD currently lists the vulnerability status as Undergoing Analysis. Vendor attribution in the supplied corpus is low confidence and should be treated cautiously.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-2611 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-2611

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-2611 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-2611

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.