PatchSiren cyber security CVE debrief
CVE-2026-2611 mlflow CVE debrief
CVE-2026-2611 is a critical remote attack surface issue in MLflow Assistant where improper origin validation on /ajax-api endpoints can let a malicious webpage interact with the Assistant on a victim’s local machine. According to the published description, this can bypass the intended loopback-only restriction, change Assistant configuration, and lead to arbitrary command execution through the Claude Code sub-agent. The issue is reported as fixed in MLflow 3.10.0.
- Vendor
- mlflow
- Product
- mlflow/mlflow
- CVSS
- CRITICAL 9.6
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-19
- Original CVE updated
- 2026-05-19
- Advisory published
- 2026-05-19
- Advisory updated
- 2026-05-19
Who should care
MLflow users running version 3.9.0, especially anyone using the MLflow Assistant feature on local workstations. Security teams should prioritize environments where users may browse untrusted websites while the Assistant is active locally.
Technical summary
The reported flaw is an origin-validation failure affecting MLflow Assistant’s /ajax-api endpoints. Because requests from a malicious webpage may be accepted despite the intended loopback-only boundary, a remote attacker can trigger cross-origin interactions against the locally running Assistant process. The described downstream impact is configuration modification that can enable broader access and, in turn, arbitrary command execution via the Claude Code sub-agent. The CVE record maps the weakness to CWE-346 and assigns CVSS 3.0 vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H.
Defensive priority
Immediate / Critical
Recommended defensive actions
- Upgrade MLflow to version 3.10.0 or later.
- Treat MLflow Assistant on local machines as exposed to cross-origin abuse until patched.
- Review whether users can access untrusted websites while the Assistant is running and reduce that exposure where possible.
- Monitor local MLflow Assistant configuration changes for unexpected updates.
- Validate that any deployment guidance or hardening intended to enforce loopback-only access remains effective after remediation.
Evidence notes
This debrief is based only on the supplied NVD record, the linked upstream GitHub commit reference, and the Huntr bounty reference. The source data states CVE-2026-2611 was published and modified on 2026-05-19, with MLflow 3.9.0 affected and 3.10.0 containing the fix. NVD currently lists the vulnerability status as Undergoing Analysis. Vendor attribution in the supplied corpus is low confidence and should be treated cautiously.
Official resources
Published by the CVE record on 2026-05-19. The supplied record indicates the vulnerability was still undergoing analysis in NVD at the time of the source snapshot.