p PatchFirst

CVE-2026-106439

CVE-2026-106439 · Hydra: Mutable instantiate policy sets allow target blocklist bypass

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

Hydra is a framework for elegantly configuring complex applications. From 1.3.4 until 1.3.7 and 1.4.0.dev10, Hydra stores legacy instantiate target blocklists and related execution-policy collections in mutable module-level state. An attacker who controls multiple sibling target entries can resolve hydra._internal.target_policy.UNCONTROLLED_EXECUTION_TARGETS.discard through instantiate(), remove a denied target, and then invoke that target because sibling nodes are processed in insertion order against the same modified policy. The mutation persists in process-global state and can enable code execution with the application's privileges, while a narrow execution whitelist supplied by trusted Python code is not bypassed by the reported direct mutation path. This issue is fixed in versions 1.3.7 and 1.4.0.dev10.

CVSS 8.5 · Alta · EPSS 0,5% · Corrección disponible

Publicación
Actualización

Pila tecnológica: python

Productos y versiones afectados

  • hydra

    Versiones
    • >= 1.3.4, < 1.3.7: Afectada
    • >= 1.4.0.dev4, < 1.4.0.dev10: Afectada

    Sin corrección publicada

  • hydra-core PyPI

    Versiones
    • 1.3.4
    • 1.3.5
    • 1.3.6
    Intervalos de versiones afectados
    • ECOSYSTEM: ≥ 1.3.4, < 1.3.7

    Actualiza a 1.3.7

  • hydra-core PyPI

    Versiones
    • 1.4.0.dev4
    • 1.4.0.dev5
    • 1.4.0.dev6
    • 1.4.0.dev8
    • 1.4.0.dev9
    Intervalos de versiones afectados
    • ECOSYSTEM: ≥ 1.4.0.dev4, < 1.4.0.dev10

    Actualiza a 1.4.0.dev10

  • hydra-core PyPI

    Versiones
    • 1.3.4
    • 1.3.5
    • 1.3.6
    • 1.4.0.dev4
    • 1.4.0.dev5
    • 1.4.0.dev6
    • 1.4.0.dev8
    • 1.4.0.dev9
    Intervalos de versiones afectados
    • ECOSYSTEM: ≥ 1.3.4, < 1.3.7 ∪ ≥ 1.4.0.dev4, < 1.4.0.dev10

    Actualiza a 1.3.7; Actualiza a 1.4.0.dev10

Fuentes originales

Comprueba tu servidor →