Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods through getattr without allowlist validation. Unauthenticated attackers can register clients, instantiate Repo resources, and invoke arbitrary methods to read experiments or delete runs.

Aim version 3.29.1's remote tracking server contains a critical authentication bypass vulnerability. The server fails to authenticate incoming requests and dispatches arbitrary methods via Python's getattr without any allowlist validation. Unauthenticated attackers can exploit this flaw to register clients, instantiate Repo resources, and invoke arbitrary methods on the server. This allows attackers to read experiment data or delete runs without any credentials. The vulnerability resides in the transport layer components, specifically server.py and tracking.py. The issue has been documented in the Aim GitHub repository and reported via VulnCheck advisories. This represents a significant risk for any organization exposing the Aim remote tracking server to untrusted networks.