CVE-2026-85663: Aim 3.29.1 Remote Code Execution via Unauthenticated Method Dispatch
Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods through getattr without allowlist validation. Unauthenticated attackers can register clients, instantiate Repo resources, and invoke arbitrary methods to read experiments or delete runs.
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running the Aim 3.29.1 remote tracking server are exposed because it accepts unauthenticated requests and dispatches methods without an allowlist. Any attacker able to reach that server over the network can exploit the issue.
What access does an attacker need?
No authentication, privileges, or user interaction are required. An attacker can register clients, create Repo resources, and invoke arbitrary methods through the remote tracking service.
What could an attacker do through the vulnerable service?
An attacker may read experiments or delete runs. The issue is also described as remote code execution through arbitrary method dispatch.