Remote Code Execution Vulnerability in Aim by AimHub
CVE-2026-85663

9.3CRITICAL

Key Information:

Vendor

Aimhubio

Status
Aim
Vendor
CVE Published:
4 September 2026

What is CVE-2026-85663?

The Aim version 3.29.1 contains a vulnerability that allows unauthenticated attackers to manipulate the remote tracking server. It fails to properly authenticate requests and permits arbitrary method invocations without necessary allowlist checks. This oversight enables malicious actors to register clients, create Repo resources, and execute arbitrary methods, potentially allowing them to read sensitive experimental data or delete existing runs.

Affected Version(s)

aim 0 <= 3.29.1

References

https://github.com/aimhubio/aim/issues/3412
issue-tracking
https://github.com/aimhubio/aim
product
https://github.com/aimhubio/aim/blob/v3.29.1/aim/ext/tran...
technical-description

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.