CVE-2026-85663
Medium
Elevated severity or exploit probability.
CVSS base
9.8
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS — probability of exploitation (30 days)
0.7%
51.3th percentile
CISA KEV
Not listed
Weakness / dates
CWE-306
Published 2026-09-04 · modified 2026-09-10
Description
Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods through getattr without allowlist validation. Unauthenticated attackers can register clients, instantiate Repo resources, and invoke arbitrary methods to read experiments or delete runs.
References
- https://github.com/aimhubio/aim
- https://github.com/aimhubio/aim/blob/v3.29.1/aim/ext/transport/server.py
- https://github.com/aimhubio/aim/blob/v3.29.1/aim/ext/transport/tracking.py
- https://github.com/aimhubio/aim/issues/3412
- https://www.vulncheck.com/advisories/aim-3.29.1-remote-code-execution-via-unauthenticated-method-dispatch
- https://github.com/aimhubio/aim/issues/3412