CVE-2026-85663CWE-306

CVE-2026-85663

Critical · published September 4, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
52.8
In the wild
Unconfirmed
What it is

Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods through getattr without allowlist validation. Unauthenticated attackers can register clients, instantiate Repo resources, and invoke arbitrary methods to read experiments or delete runs.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00704 · 52.8th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-09-04T19:17Z
References (6)
https://github.com/aimhubio/aim · [email protected]https://github.com/aimhubio/aim/blob/v3.29.1/aim/ext/transport/server.py · [email protected]https://github.com/aimhubio/aim/blob/v3.29.1/aim/ext/transport/tracking.py · [email protected]https://github.com/aimhubio/aim/issues/3412 · [email protected]https://www.vulncheck.com/advisories/aim-3.29.1-remote-code-execution-via-unauthenticated-method-dispatch · [email protected]https://github.com/aimhubio/aim/issues/3412 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 06 SEP 03:33Z
    EPSS moved — → 1%
    epss
  • 04 SEP 14:32Z
    Aim 3.29.1 Remote Code Execution via Unauthenticated Method Dispatch
    cvelistv5