CVE-2026-85663

CVSS 9.8 (critical) · published 2026-09-04

Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods through getattr without allowlist validation. Unauthenticated attackers can register clients, instantiate Repo resources, and invoke arbitrary methods to read experiments or delete runs.

Weakness: CWE-306

Source: NVD CVE-2026-85663

References

• https://github.com/aimhubio/aim
• https://github.com/aimhubio/aim/blob/v3.29.1/aim/ext/transport/server.py
• https://github.com/aimhubio/aim/blob/v3.29.1/aim/ext/transport/tracking.py
• https://github.com/aimhubio/aim/issues/3412
• https://www.vulncheck.com/advisories/aim-3.29.1-remote-code-execution-via-unauthenticated-method-dispatch
• https://github.com/aimhubio/aim/issues/3412

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.