In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow Assistant running on a victim's local machine. By bypassing the loopback-only restriction, the attacker can modify the Assistant's configuration to enable full access, which in turn allows the execution of arbitrary commands via the Claude Code sub-agent. This issue is resolved in version 3.10.0.
An attacker prepares a malicious website from which cross-origin requests are sent to the /ajax-api endpoints of MLflow Assistant running on the victim's local machine. The vulnerability stems from improper origin validation, which allows bypassing the restriction to loopback access (localhost) only. After gaining access, the attacker modifies the Assistant's configuration to enable full access, then executes arbitrary system commands through the Claude Code sub-agent.
An attacker can gain full control over MLflow Assistant configuration and execute arbitrary commands on the victim's machine, resulting in complete compromise of system confidentiality, integrity, and availability.
Update MLflow to version 3.10.0, in which the issue has been resolved. The patch is available in the project repository (commit 8f9c8a53af90842944101eb8b7d60706822c81bc).
MLflow version 3.9.0 with MLflow Assistant feature enabled.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HLfprojects Mlflow
APPLfprojects3.9.0 – 3.10.0 (excl.)
Related vulnerabilities
MLflow is an open source AI engineering platform for agents, large language models, and machine learning model...
MLflow: nieautoryzowany dostęp do endpointów multipart upload (RCE)
Brak uwierzytelnienia w endpointach FastAPI jobs w MLflow (Auth Bypass / RCE)
Path traversal w MLflow — nadpisanie plików i eskalacja uprawnień
Command injection w MLflow podczas inicjalizacji kontenera modelu