Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability CVE-2026-85663 in Aim 3.29.1 stems from a critical lack of authentication combined with an unsafe method dispatch mechanism on the remote tracking server. The TrackingRouter class, specifically its get_resource, run_instruction, and run_write_instructions methods, are the core components of this vulnerability.
Unauthenticated Resource Instantiation (TrackingRouter.get_resource): The get_resource endpoint (lines 119-177 in aim/ext/transport/tracking.py) allows any unauthenticated client to request the instantiation of various resource types (e.g., 'Repo', 'TreeView', 'FileManager') by providing a resource_type and args in the request body. This is the initial entry point for an attacker to gain access to server-side objects. The client_uri parameter is merely an identifier and is not authenticated.
Arbitrary Method Dispatch (TrackingRouter.run_instruction and TrackingRouter.run_write_instructions): Once a resource object is instantiated and a resource_handler is obtained (which is just a UUID), an unauthenticated attacker can then call run_instruction (via POST, lines 180-220) or run_write_instructions (via WebSocket, lines 223-245). These functions take a method_name and args from the client. Crucially, they use Python's built-in getattr() and setattr() functions directly on the server-side resource object with the attacker-controlled method_name. There is no allowlist or denylist to restrict which methods can be called or which attributes can be set. The _verify_resource_handler function only checks if the resource_handler exists and is associated with the provided client_uri, but it does not authenticate the client_uri itself.
This combination allows an unauthenticated attacker to:
Repo object (or other sensitive objects like FileManager).Repo object (e.g., Repo.query_runs, Repo.delete_run) to read experiment data, delete runs, or potentially execute other sensitive operations exposed by the Repo or other registered resource types.The fix would involve implementing robust authentication for all endpoints that handle resource management and method dispatch, and/or implementing a strict allowlist for methods that can be invoked remotely.
TrackingRouter.get_resourceaim/ext/transport/tracking.py
TrackingRouter.run_instructionaim/ext/transport/tracking.py
TrackingRouter.run_write_instructionsaim/ext/transport/tracking.py