CVE-2026-85663

CRITICAL 9.8

Aim 3.29.1 Remote Code Execution via Unauthenticated Method Dispatch

CVSS Score

9.8

EPSS Score

0.0%

EPSS Percentile

0th

Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods through getattr without allowlist validation. Unauthenticated attackers can register clients, instantiate Repo resources, and invoke arbitrary methods to read experiments or delete runs.

CWE	CWE-306
Vendor	aimhubio
Product	aim
Published	Sep 4, 2026
Last Updated	Sep 4, 2026

Stay Ahead of the Next One

Get instant alerts for aimhubio aim

Be the first to know when new critical vulnerabilities affecting aimhubio aim are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

aimhubio / aim

0 ≤ 3.29.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/aimhubio/aim/issues/3412 github.com: https://github.com/aimhubio/aim github.com: https://github.com/aimhubio/aim/blob/v3.29.1/aim/ext/transport/tracking.py github.com: https://github.com/aimhubio/aim/blob/v3.29.1/aim/ext/transport/server.py vulncheck.com: https://www.vulncheck.com/advisories/aim-3.29.1-remote-code-execution-via-unauthenticated-method-dispatch

Credits

George Chen