CVE-2026-84452: Windows ML CLI RCE Vulnerability

CVE-2026-84452 Overview

CVE-2026-84452 affects Microsoft's Windows ML CLI, a command line tool for building portable AI models for Windows ML. The vulnerability stems from an unauthenticated localhost HTTP API combined with a wildcard allow_origins CORS configuration in src/winml/modelkit/serve/cli_api.py and src/winml/modelkit/serve/app.py. A malicious website can send cross-origin requests to /v1/cli/build or /v1/cli/config with trust_remote_code=true, which flows unvalidated into AutoConfig.from_pretrained. This causes Python code from an attacker-controlled model repository to execute as the server user. The issue is fixed in version 0.4.0.

Critical Impact
Arbitrary code execution as the local server user through a drive-by web visit while winml-cli serve is running.

Affected Products

Microsoft Windows ML CLI versions prior to 0.4.0
src/winml/modelkit/serve/cli_api.py HTTP API component
src/winml/modelkit/loader/_autoconfig.py model loader component

Discovery Timeline

2026-09-02 - CVE-2026-84452 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84452

Vulnerability Analysis

Windows ML CLI exposes a local HTTP server through its serve subcommand. The server accepts commands on /v1/cli/build and /v1/cli/config without authentication. The associated FastAPI application sets CORS allow_origins to a wildcard, permitting any origin to issue cross-origin requests. This combination transforms a local developer tool into a browser-reachable remote code execution surface. This is classified as [CWE-306] Missing Authentication for Critical Function.

When a request specifies trust_remote_code=true, the parameter is translated to the --trust-remote-code command-line flag with no validation. The loader then calls AutoConfig.from_pretrained with trust_remote_code=True, which imports and executes Python code from a Hugging Face-style model repository controlled by the attacker.

Root Cause

Two compounding design flaws create the vulnerability. First, the serve API has no authentication token or origin validation. Second, trust_remote_code is a security-critical toggle that must never be reachable from untrusted input, yet it is exposed as a plain request parameter. The transformers library documentation explicitly warns that trust_remote_code=True allows arbitrary code execution.

Attack Vector

A developer runs winml-cli serve on localhost. While the service is running, the user visits an attacker-controlled webpage. JavaScript on that page issues a cross-origin fetch to the local API endpoint, supplying a malicious model repository URL and setting trust_remote_code to true. The server fetches the repository and executes attacker Python code with the developer's privileges.

python

# Security patch in src/winml/modelkit/loader/_autoconfig.py
# Source: https://github.com/microsoft/winml-cli/commit/f4073e0ef4700a25b623487e7e45c421ca0b9993
    first tries identifier-based concrete config inference and otherwise
    returns a tagged generic config.
"""
if trust_remote_code:
    from ..utils._security import _require_remote_code_execution_allowed

    _require_remote_code_execution_allowed()

from transformers import PretrainedConfig, __version__

load_kwargs = kwargs.copy()

The patch gates trust_remote_code behind an explicit server-side authorization check, preventing untrusted callers from enabling remote code loading. See the GitHub Security Advisory GHSA-96p9-rh4f-92cf for full details.

Detection Methods for CVE-2026-84452

Indicators of Compromise

Unexpected outbound connections from developer workstations to unknown model repository hosts after visiting a website
HTTP requests to http://127.0.0.1:*/v1/cli/build or /v1/cli/config with an Origin header pointing to an external domain
Child processes spawned by winml-cli or its Python interpreter that are unrelated to model conversion tasks
New files written under user cache directories such as %USERPROFILE%\.cache\huggingface from unfamiliar model repositories

Detection Strategies

Inspect proxy and firewall logs for cross-origin requests targeting loopback ports used by winml-cli serve
Alert on Python processes owned by developers executing shells, PowerShell, or network utilities during model conversion workflows
Monitor for winml-cli invocations that include --trust-remote-code or serve mode running for extended periods

Monitoring Recommendations

Ingest endpoint process telemetry into a centralized data lake and correlate browser activity with local API traffic
Establish a baseline of normal winml-cli behavior on developer endpoints and alert on deviations
Track outbound HTTPS to huggingface.co and mirrors from processes other than approved developer tooling

How to Mitigate CVE-2026-84452

Immediate Actions Required

Upgrade Windows ML CLI to version 0.4.0 or later on all developer and build systems
Terminate any running winml-cli serve instances until the upgrade is complete
Audit developer endpoints for unexpected Python child processes and unauthorized model downloads during the exposure window
Restrict browser access to untrusted sites on machines that run local ML tooling

Patch Information

The fix is available in Windows ML CLI 0.4.0. The patch hardens CLI API security boundaries, gates trust_remote_code behind an explicit authorization function _require_remote_code_execution_allowed, and disables proxy header trust in uvicorn. Review the GitHub Pull Request #1321 and the remediation commit for implementation details.

Workarounds

Do not run winml-cli serve on shared or internet-connected workstations until patched
Bind the serve endpoint only when needed and shut it down immediately after use
Block outbound connections from winml-cli processes to non-approved model registries using host firewall rules
Use browser isolation or a dedicated build host to prevent drive-by requests from reaching the localhost API

bash

# Configuration example - upgrade to the patched release
pip install --upgrade "winml-cli>=0.4.0"

# Verify version
winml-cli --version