CVE-2026-85663 Details
Description
Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods through getattr without allowlist validation. Unauthenticated attackers can register clients, instantiate Repo resources, and invoke arbitrary methods to read experiments or delete runs.
A remote code execution vulnerability exists in Aim version 3.29.1. The issue arises because the tracking server does not authenticate requests and allows unauthenticated attackers to dispatch arbitrary methods on server-side resources. Exploitation can lead to unauthorized access to experiment data and the ability to delete experiment runs. The vulnerability is caused by the server's RPC interface, which blindly executes methods specified by the client without any validation or authentication.
It is recommended to require authentication on the tracking server and to implement a per-resource-type allowlist for methods that can be invoked, rejecting any unauthorized access.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 4, 2026CISA-ADP
Assessed Sep 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/aimhubio/aim/issues/3412 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/aimhubio/aim | [email protected] | Vendor |
| https://github.com/aimhubio/aim/blob/v3.29.1/aim/ext/transport/server.py | [email protected] | Source CodeVendor |
| https://github.com/aimhubio/aim/blob/v3.29.1/aim/ext/transport/tracking.py | [email protected] | Source CodeVendor |
| https://github.com/aimhubio/aim/issues/3412 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/aim-3.29.1-remote-code-execution-via-unauthenticated-method-dispatch | [email protected] | AdvisoryBundleVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Aim | <= 3.29.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 4, 2026 | CVE Modified | CISA-ADP |
| Sep 4, 2026 | New CVE Received | [email protected] |