by Kastro
Paper/Archive/CVE-2026-85663

CVE-2026-85663

aimhubio aim — Aim 3.29.1 Remote Code Execution via Unauthenticated Method Dispatch

EPSS 0.7%public exploitCVSS 9.8
critical.is priorityof 100
50
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 53.3.533 × 2010.7Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods through getattr without allowlist validation. Unauthenticated attackers can register clients, instantiate Repo resources, and invoke arbitrary methods to read experiments or delete runs.

Affected

ProductAffectedFixed inSource
aim≤ 3.29.1–CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/aimhubio/aim/issues/3412refgithub.com/aimhubio/aimwriteupgithub.com/aimhubio/aim/blob/v3.29.1/aim/ext/transport/tracking.pywriteupgithub.com/aimhubio/aim/blob/v3.29.1/aim/ext/transport/server.pywriteupvulncheck.com/advisories/aim-3.29.1-remote-code-execution-via-unauthenticated-method-dispatch