CVE-2026-2611 is a critical vulnerability (CVSS 9.6) in MLflow version 3.9.0 involving improper origin validation (CWE-346) in the MLflow Assistant's /ajax-api endpoints. This weakness allows remote attackers to bypass loopback-only restrictions by exploiting cross-origin requests from malicious web pages. Successful exploitation lets attackers alter the Assistant's configuration to enable full access, which leads to arbitrary command execution via the Claude Code sub-agent. The vulnerability affects versions >=3.9.0 and <3.10.0 and is fixed in version 3.10.0. No known exploits in the wild have been reported. The vendor advisory from Red Hat confirms the issue and its resolution.

An attacker can remotely bypass origin restrictions to interact with the MLflow Assistant on a victim's local machine. This enables modification of the Assistant's configuration to gain full access, resulting in the ability to execute arbitrary commands. The impact includes complete confidentiality, integrity, and availability compromise of the affected system.

Upgrade MLflow to version 3.10.0 or later, where this vulnerability is fixed. The vendor advisory confirms the fix is available in 3.10.0. No other mitigations are indicated by the vendor advisory.