CVE-2026-2611

In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow Assistant running on a victim's local machine. By bypassing the loopback-only restriction, the attacker can modify the Assistant's configuration to enable full access, which in turn allows the execution of arbitrary commands via the Claude Code sub-agent. This issue is resolved in version 3.10.0.

• CWE-346
• CWE-940

• https://github.com/mlflow/mlflow/commit/8f9c8a53af90842944101eb8b7d60706822c81bcPatch
• https://huntr.com/bounties/8462addd-b464-4a84-b6a2-5529604e6e5aExploit, Third Party Advisory
• https://access.redhat.com/security/cve/CVE-2026-2611
• https://bugzilla.redhat.com/show_bug.cgi?id=2479797
• https://huntr.com/bounties/8462addd-b464-4a84-b6a2-5529604e6e5aExploit, Third Party Advisory
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2611.json

Published

May 19, 2026

Last Modified

Jul 15, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-26104A flaw was found in the udisks storage management daemon tha…5.5
• CVE-2026-26105Improper neutralization of input during web page generation …9.3
• CVE-2026-26106Improper input validation in Microsoft Office SharePoint all…8.8
• CVE-2026-26107Use after free in Microsoft Office Excel allows an unauthori…7.8
• CVE-2026-26108Heap-based buffer overflow in Microsoft Office Excel allows …7.8
• CVE-2026-26109Out-of-bounds read in Microsoft Office Excel allows an unaut…7.8
• CVE-2026-26110Access of resource using incompatible type ('type confusion'…7.8
• CVE-2026-26111Integer overflow or wraparound in Windows Routing and Remote…8
• CVE-2026-26112Untrusted pointer dereference in Microsoft Office Excel allo…7.8
• CVE-2026-26113Untrusted pointer dereference in Microsoft Office allows an …7.8
• CVE-2026-26114Deserialization of untrusted data in Microsoft Office ShareP…8.8
• CVE-2026-26115Improper validation of specified type of input in SQL Server…8.8