- The Mess: Aim’s remote tracking server has no authentication and lets attackers dynamically invoke server-side methods through Python’s
getattr(). CVE-2026-85663 carries a CVSS 9.8 Critical score and affects Aim versions through 3.29.1.
Aim is an experiment-tracking platform for machine learning teams.
It stores the stuff ML engineers care about: experiments, runs, parameters, metrics and artifacts.
Its remote tracking server is supposed to let clients talk to that data.
The problem is that the server trusts the client far too much.
There is no authentication check before the remote tracking protocol starts processing requests. Worse, the server uses Python’s getattr() to resolve methods dynamically without enforcing an allowlist of operations.
That means the client isn’t restricted to a carefully defined set of safe actions.
It can ask the server to instantiate objects and invoke methods on them.
The vulnerable server accepts a client registration, creates a Repo object and then processes method calls against server-side objects.
That’s an RPC interface with the security equivalent of an open front door and a receptionist who will dial whatever extension the visitor names.
- The Damage: An unauthenticated network attacker can read experiment data, delete tracked runs and potentially push the arbitrary-method mechanism into full remote code execution.
The immediate impact is already serious.
An attacker who can reach the tracking server does not need an Aim account.
No credentials.
No token.
No user interaction.
The attacker can register a client and interact with the remote tracking protocol directly.
The CVE description specifically identifies the ability to read experiments and delete runs.
For an ML team, that can mean more than losing a dashboard.
Experiment tracking can contain proprietary model-development information, dataset metadata, parameters, evaluation results and other details that reveal how a system was built.
Then there is the more interesting part.
The vulnerable code dispatches methods through unchecked getattr().
That’s dangerous because the security boundary isn’t “these three safe methods are available.”
It is effectively:
Tell me the object. Tell me the method. I’ll try to call it.
The exact impact depends on which server-side objects and methods are reachable in the deployed configuration. The vulnerability is nevertheless classified as remote code execution by the CVE record and its primary advisory, with CVSS 3.1 9.8 Critical and CVSS 4.0 9.3 Critical.
The attack conditions are particularly ugly:
Network reachable.
Low complexity.
No privileges.
No user interaction.
High confidentiality, integrity and availability impact.
That’s essentially the dream configuration for an attacker looking for exposed ML infrastructure.
And there is another signal worth watching.
The CISA ADP enrichment attached to the CVE currently marks the issue with Exploitation: poc, Automatable: yes and Technical Impact: total.
That does not mean we have confirmed widespread exploitation.
It does mean defenders should stop treating this as an obscure theoretical bug.
- The Fix: Do not expose the Aim remote tracking server to untrusted networks, and move beyond Aim 3.29.1 to a release that enforces authentication and restricts remotely callable methods.
The affected range currently listed by the CVE record is Aim 0 through 3.29.1 inclusive.
The project-specific patch information is still less clean than it should be. Current vulnerability tracking recommends upgrading to a release beyond 3.29.1 with authentication and method allowlisting implemented.
If an upgrade cannot happen immediately, isolate the tracking server.
Do not expose its listening port to the Internet.
Restrict access to known ML infrastructure.
Use firewall rules, segmentation, VPN access or an authenticated reverse proxy.
Then check the logs.
Look for unexpected client registrations.
Look for connections from unfamiliar hosts.
Look for unusual RPC requests.
Look for attempts to access or delete experiments that nobody on the team initiated.
If the server was publicly reachable while running a vulnerable version, assume that its data may have been exposed.
And don’t forget backups.
An attacker who can delete experiment runs can destroy the history needed to reproduce models, investigate failures or prove what happened.
For ML teams, that data is part of the production asset — not disposable telemetry.
There is currently no confirmed evidence of widespread active exploitation, and one current tracker reports no public PoC despite the CISA ADP exploitation classification.
That discrepancy is exactly why defenders should focus on exposure rather than waiting for an exploit video.
If the service is reachable by strangers, the problem already exists.
Bugstoday’s Opinion
This is what happens when an RPC interface forgets that the other side is hostile.
getattr() is convenient.
It’s also a terrible security boundary when the attacker controls what gets resolved.
Aim didn’t need a spectacular memory corruption bug.
It gave an unauthenticated network client a mechanism for asking the server to perform operations it was never supposed to expose.
And this is sitting inside an ML stack.
Everyone is busy worrying about poisoned models, malicious datasets and prompt injection.
Meanwhile, the tracking server can be asked to call things it probably shouldn’t.
That’s the kind of bug attackers love.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
CVE-2026-85663
CVE.org / MITRE
NVD
Aim / aimhubio GitHub
GitHub Issue #3412
VulnCheck Advisory
CISA ADP Vulnrichment
