CVE-2026-85663

The remote tracking server in Aim 3.29.1 does not authenticate incoming requests (CWE-306, Missing Authentication for Critical Function) and dispatches requested operations via Python getattr without validating them against an allowlist of permitted methods. An unauthenticated attacker with network access to the server can register a client, instantiate a Repo resource, and invoke arbitrary methods through this unrestricted dispatch. This allows the attacker to read tracked ML experiment data, delete runs, and otherwise tamper with the experiment repository, consistent with the critical 9.3 CVSS 4.0 score (network vector, no privileges or user interaction, high loss of confidentiality, integrity, and availability). Any deployment running the Aim 3.29.1 remote tracking server is affected, with risk highest for instances exposed to untrusted networks or the internet. No public proof-of-concept or in-the-wild exploitation is currently known; EPSS assigns a low 0.5% probability of exploitation within the next 30 days (percentile 41).

What to do: Check Aimstack advisories for a patched release and upgrade from 3.29.1 as soon as a fix is published. Until then, restrict the tracking server to trusted networks via firewall/VPN rules or place it behind an authenticating reverse proxy, and avoid exposing its port directly to the internet. Review the experiment repository for runs that were unexpectedly deleted or modified.