The vulnerability in the MLflow Assistant feature is a CWE‑346 Improper Origin Validation and also involves CWE‑940 Missing Encryption when Sending Sensitive Information, allowing a remote attacker to bypass the intended loopback‑only restriction on the /ajax‑api endpoints. By sending cross‑origin requests from a malicious web page, the attacker can alter the Assistant’s configuration to enable full access. Once privileged, the attacker can employ the Claude Code sub‑agent to execute arbitrary commands on the victim’s machine, leading to complete compromise of confidentiality, integrity, and availability.

MLflow 3.9.0 is affected. The issue is fixed in version 3.10.0. No other versions are listed as vulnerable.

The CVSS score of 9.6 indicates high severity. The EPSS score of <1% indicates a very low but non‑zero likelihood of exploitation, and the vulnerability is not in the CISA KEV catalog. The likely attack vector is a remote attacker controlling a web page that performs cross‑origin AJAX requests to an MLflow instance running locally. If successful, the attacker can modify configuration and run arbitrary code via the Assistant’s sub‑agent. The lack of mitigation means the risk remains open until the patch is applied or a temporary workaround is enforced.