# CVE-2026-85663: Aim remote tracking server authentication bypass and arbitrary method invocation

Source: https://junglewise.ai/threats/cve-2026-85663-aim-remote-tracking-server-authentication-bypass-and-arbitrary  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-85663 · Severity: critical · CVSS 9.8 · Published 2026-09-04

Aim is an open-source experiment tracking platform used by data scientists to manage and compare machine learning experiments. The remote tracking server fails to authenticate incoming requests and allows unauthenticated attackers to invoke arbitrary Python methods through unsafe use of getattr(), enabling attackers to read sensitive experiments, delete runs, or access underlying data without any credentials.

Technologies: [Aim](https://junglewise.ai/threats/technologies/aim). Vendors: [Aim](https://junglewise.ai/threats/vendors/aim).

## Quick answers

**Is CVE-2026-85663 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85663 being exploited in the wild.

**How severe is CVE-2026-85663?** Critical severity, with a CVSS score of 9.8, published 4 September 2026.

**Which products and versions are affected?** Aim 3.29.1.

**Is there a fix for CVE-2026-85663?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-85663 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-85663?** Check whether you run Aim at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a combination of missing authentication and unsafe object method dispatch. The TrackingRouter in the remote server fails to validate authentication on tracking endpoints and uses getattr() without an allowlist to dynamically invoke methods on registered resource objects (Repo, StructuredRun, etc.). An unauthenticated attacker can register clients, instantiate Repo resources, and chain method calls to invoke arbitrary public methods on the resource objects, reading sensitive experiment metadata or deleting runs. The vulnerability affects the /tracking endpoint and requires network access to the Aim tracking server; no authentication or special preconditions are needed. No patch information is provided in the advisory.

## Affected products

- Aim Aim 3.29.1

## Timeline

- 2026-09-04: disclosed

## References

- [https://github.com/aimhubio/aim](https://github.com/aimhubio/aim)
- [https://github.com/aimhubio/aim/blob/v3.29.1/aim/ext/transport/server.py](https://github.com/aimhubio/aim/blob/v3.29.1/aim/ext/transport/server.py)

## Related threats

- [PYSEC-2026-1082 - Aim vulnerable to Cross-Site Request Forgery](https://junglewise.ai/threats/cve-2024-7760-aim-csrf-vulnerability-in-tracking-server)