CVE-2026-2611: lfprojects mlflow Origin Validation Error
Vulnerability summary
CVE-2026-2611 is a critical (CVSS 9.6) Origin Validation Error vulnerability in lfprojects mlflow. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 34.3% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 19-05-2026PublishedVulnerability first disclosed.
- 15-07-2026Last modifiedVulnerability information updated.
Description
In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow Assistant running on a victim's local machine. By bypassing the loopback-only restriction, the attacker can modify the Assistant's configuration to enable full access, which in turn allows the execution of arbitrary commands via the Claude Code sub-agent. This issue is resolved in version 3.10.0.
CVSS metrics
5 scores · 3 sources · 2 versions- NVDNIST9.6CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
- OSV · PypiEcosystem advisory · calculated9.6CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
- NVDNIST9.6CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
EPSS trend
Probability
0.41%
Chance of exploitation in the next 30 days
Percentile
34%
Versus all other CVEs
30-day change
+0.03 pp
From 0.38% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (huntr.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-346Origin Validation ErrorThe product does not properly verify that the source of data or communication is valid.
- CWE-940Improper Verification of Source of a Communication ChannelThe product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.
Affected systems
Lfprojects1 product
- mlflow≥ 3.9.0, < 3.10.0
Mlflow1 product
- mlflow/mlflow≥ unspecified, < 3.10.0
PyPI1 product
- mlflow≥ 3.9.0, < 3.10.0
3 vendors · 3 products
References
10 links
- github.com/mlflow/mlflowPACKAGE