MLflow Assistant Origin Validation Bypass Enables Remote Code Execution

In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow Assistant running on a victim's local machine. By bypassing the loopback-only restriction, the attacker can modify the Assistant's configuration to enable full access, which in turn allows the execution of arbitrary commands via the Claude Code sub-agent. This issue is resolved in version 3.10.0.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-2611 is a critical cross-origin request forgery (CSRF) vulnerability affecting MLflow version 3.0.0's newly introduced Assistant feature. The vulnerability stems from improper origin validation in /ajax-api endpoints, allowing attackers to bypass loopback-only restrictions from malicious webpages. By exploiting this weakness, remote attackers can modify the MLflow Assistant's configuration and execute arbitrary commands through the Claude Code sub-agent, potentially compromising any developer or data scientist running a vulnerable MLflow instance locally. Organizations using MLflow for ML model tracking and experimentation are directly at risk, particularly in environments where users browse untrusted content while working with MLflow.

Casky's 301 mapped security skills detect this attack pattern by correlating MITRE ATT&CK techniques TA0001 (Initial Access) and TA0043 (Reconnaissance) with behavioral indicators of origin validation bypass attempts. Claude's extended reasoning capabilities identify suspicious /ajax-api requests originating from cross-origin sources, configuration modification patterns inconsistent with normal MLflow usage, and subsequent command execution attempts that deviate from legitimate Assistant workflows. Practitioners using Casky would observe findings highlighting unauthorized origin requests, unexpected configuration changes to Assistant settings, and anomalous Claude Code invocations—providing early warning of exploitation attempts before arbitrary code execution occurs on the victim's machine.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-2611.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-2611

Casky has 301 skills that investigate the attack patterns behind CVE-2026-2611. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn