CVE-2026-85663

EUVD-2026-71119
Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods through getattr without allowlist validation. Unauthenticated attackers can register clients, instantiate Repo resources, and invoke arbitrary methods to read experiments or delete runs.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/aimhubio/aim
https://github.com/aimhubio/aim/blob/v3.29.1/aim/ext/transport/server.py
https://github.com/aimhubio/aim/blob/v3.29.1/aim/ext/transport/tracking.py
https://github.com/aimhubio/aim/issues/3412
https://www.vulncheck.com/advisories/aim-3.29.1-remote-code-execution-via-unauthenticated-method-dispatch
https://github.com/aimhubio/aim/issues/3412