CVE-2026-85663: Aim Tracking Server Auth Bypass Vulnerability

CVE-2026-85663 Overview

CVE-2026-85663 is a critical missing authentication vulnerability [CWE-306] in the Aim experiment tracking platform version 3.29.1. The remote tracking server fails to authenticate incoming requests and dispatches arbitrary methods through Python's getattr without allowlist validation. Unauthenticated network attackers can register clients, instantiate Repo resources, and invoke arbitrary methods on server-side objects. Exploitation allows adversaries to read experiment data, delete tracked runs, and abuse exposed methods to compromise machine learning workflows relying on Aim for experiment tracking.

Critical Impact
Remote unauthenticated attackers can dispatch arbitrary methods against the Aim tracking server, exposing experiment data and enabling destructive operations against tracked runs.

Affected Products

Aim experiment tracking platform version 3.29.1
Aim remote tracking server component (aim/ext/transport/server.py)
Aim tracking transport layer (aim/ext/transport/tracking.py)

Discovery Timeline

2026-09-04 - CVE-2026-85663 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-85663

Vulnerability Analysis

Aim is an open-source experiment tracking tool used by machine learning teams to log, compare, and analyze training runs. Version 3.29.1 ships a remote tracking server that exposes a transport layer for clients to record metrics and interact with repository objects. The server accepts client registration and resource instantiation without verifying caller identity or authorization.

Once a client registers, the server exposes an RPC-style dispatch that resolves method names on resource objects through getattr. Because no allowlist restricts which attributes can be resolved, an attacker can invoke any method exposed on the Repo class or related tracking resources. This includes methods that read experiment metadata, enumerate runs, or delete tracked data.

Root Cause

The root cause is the combination of two defects. First, the tracking server omits an authentication layer on transport endpoints defined in aim/ext/transport/server.py. Second, the dispatch logic in aim/ext/transport/tracking.py uses unrestricted attribute lookup via getattr without an allowlist that limits callable methods to a safe subset. Together these defects satisfy CWE-306 (Missing Authentication for Critical Function).

Attack Vector

Exploitation requires only network reachability to the Aim remote tracking server. An attacker sends a client registration request, obtains a client handle, instantiates a Repo resource on the server, and issues method invocations by name. Because Aim deployments frequently run on internal networks with the tracking port exposed to any developer workstation, lateral movement into the tracking service is often trivial. See the VulnCheck Aim 3.29.1 Advisory for the full exploitation walkthrough. Technical implementation details are available in the GitHub Aim Server Script and GitHub Aim Tracking Script.

Detection Methods for CVE-2026-85663

Indicators of Compromise

Unexpected client registration requests to the Aim tracking server from unrecognized source addresses.
Requests targeting the transport endpoints defined in aim/ext/transport/server.py originating outside the ML engineering subnet.
Sudden disappearance of experiment runs or repository entries without corresponding user activity in audit logs.
Network flows to the Aim tracking port (default 53800) from workstations that do not run training jobs.

Detection Strategies

Inspect Aim server access logs for high volumes of resource instantiation calls followed by diverse method invocations from a single client identifier.
Baseline the set of methods normally invoked by production training pipelines and alert on calls that deviate from that set.
Monitor for Repo instantiation events tied to client sessions that never emit metric-write operations.

Monitoring Recommendations

Forward Aim tracking server logs and network flow data to a centralized analytics platform for correlation with authentication events.
Alert on any inbound connection to Aim tracking ports from outside approved CIDR ranges.
Track deletion operations against experiment repositories and require secondary verification for bulk removals.

How to Mitigate CVE-2026-85663

Immediate Actions Required

Restrict network access to the Aim tracking server so only trusted training hosts can reach the transport port.
Place the Aim server behind an authenticating reverse proxy that enforces mutual TLS or token-based access control.
Audit existing experiment repositories for unauthorized deletions or exfiltration since the server was first exposed.
Disable the remote tracking server if it is not required and use local file-based tracking instead.

Patch Information

At the time of publication, no fixed release addressing CVE-2026-85663 is referenced in the NVD entry. Track GitHub Issue #3412 and the GitHub Aim Repository for upstream remediation. Apply any vendor-published patch as soon as it becomes available and rotate any credentials that may have been reachable through the tracking service.

Workarounds

Bind the Aim tracking server to 127.0.0.1 and tunnel access through SSH or a VPN with per-user authentication.
Enforce host-based firewall rules that deny inbound connections to the tracking port from untrusted segments.
Deploy a network policy in Kubernetes environments that restricts ingress to the Aim pod to a known set of training namespaces.
Replace the remote tracking deployment with local logging until an authenticated release ships.

bash

# Configuration example: restrict Aim tracking port with iptables
iptables -A INPUT -p tcp --dport 53800 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 53800 -j DROP