9.6

CVSS Score

3.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-2611

CVE-2026-2611: MLflow: Improper Origin Validation in MLflow Assistant /ajax-api Endpoints Enables Browser-Mediated Local Command Execution

In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow Assistant running on a victim's local machine. By bypassing the loopback-only restriction, the attacker can modify the Assistant's configuration to enable full access, which in turn allows the execution of arbitrary commands via the Claude Code sub-agent. This issue is resolved in version 3.10.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-2611

CVE-2026-2611:

9.6

CVSS Score

3.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
mlflow	pip	= 3.9.0	3.10.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists because the /ajax-api endpoints of the MLflow Assistant were not protected against Cross-Site Request Forgery (CSRF) attacks due to improper CORS configuration. A malicious webpage could send requests to the locally running MLflow instance and execute commands.

The analysis of the patch 8f9c8a53af90842944101eb8b7d60706822c81bc reveals two key changes that fix the vulnerability:

mlflow.server.security_utils.is_api_endpoint: This function is used to determine if a given request path should be subject to API security checks, including CORS validation. Before the patch, this function only checked for paths starting with /api/. The new MLflow Assistant feature introduced endpoints under /ajax-api/, which were not covered. The patch extends the check to include /ajax-api/, ensuring these new endpoints are protected. The vulnerable version of this function failed to identify the new assistant endpoints, leaving them exposed.
mlflow.server.fastapi_security.init_fastapi_security: This function sets up the CORS middleware for the FastAPI application. The patch modifies this function to implement a stricter CORS policy. It introduces CORSBlockingMiddleware to block cross-origin requests by default and configures CORSMiddleware to only allow requests from localhost origins for the assistant endpoints. This prevents malicious websites from interacting with the local MLflow server. The previous configuration was too permissive.

Therefore, an exploit would involve a request to an /ajax-api endpoint, which would be processed by the middleware configured by init_fastapi_security, and the decision to apply the middleware would be based on the result of is_api_endpoint. These two functions are central to the vulnerability.

Vulnerable functions

is_api_endpoint

mlflow/server/security_utils.py

This function is responsible for determining if a request path is an API endpoint that requires CORS protection. Before the patch, it did not recognize paths starting with `/ajax-api/`, which are used by the MLflow Assistant. This omission left the assistant's endpoints unprotected from cross-origin requests, allowing malicious websites to make requests to them and execute commands.

init_fastapi_security

mlflow/server/fastapi_security.py

This function configures the security middleware for the FastAPI application. The previous implementation could be configured to allow all origins (`"*"`) for API endpoints, which is a security risk. The patch tightens this by default to only allow localhost origins for the assistant's endpoints, thus mitigating the cross-origin attack vector. While the primary issue was that `is_api_endpoint` didn't cover the new endpoints, the overly permissive fallback configuration in this function was a contributing factor.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.