p PatchFirst

CVE-2026-106442

CVE-2026-106442 · Hydra instantiate target blacklist bypasses permit code execution

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Hydra is a framework for elegantly configuring complex applications. From 1.3.4 until 1.3.6 and 1.4.0.dev9, the instantiate() target blacklist introduced for CVE-2026-68508 incompletely checks the effective callable selected by the target field. Execution wrappers such as timeit.timeit, executable deserialization through pickle.loads, aliases, callable-returning helpers, generic dispatch, and deferred calls can obscure or defer the effective target and bypass name-based authorization. An attacker who causes an application to instantiate untrusted Hydra configuration can use these gaps to execute code with the application's privileges. This issue is fixed in versions 1.3.6 and 1.4.0.dev9.

CVSS 7.8 · High · EPSS 0.2% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • hydra

    Versions
    • >= 1.3.4, < 1.3.6: Affected
    • >= 1.4.0.dev0, < 1.4.0.dev9: Affected

    No fix published

  • hydra-core PyPI

    Versions
    • 1.3.4
    • 1.3.5
    Affected ranges
    • ECOSYSTEM: ≥ 1.3.4, < 1.3.6

    Update to 1.3.6

  • hydra-core PyPI

    Versions
    • 1.4.0.dev1
    • 1.4.0.dev3
    • 1.4.0.dev4
    • 1.4.0.dev5
    • 1.4.0.dev6
    • 1.4.0.dev8
    Affected ranges
    • ECOSYSTEM: ≥ 1.4.0.dev0, < 1.4.0.dev9

    Update to 1.4.0.dev9

  • hydra-core PyPI

    Versions
    • 1.3.4
    • 1.3.5
    • 1.4.0.dev1
    • 1.4.0.dev3
    • 1.4.0.dev4
    • 1.4.0.dev5
    • 1.4.0.dev6
    • 1.4.0.dev8
    Affected ranges
    • ECOSYSTEM: ≥ 1.3.4, < 1.3.6 ∪ ≥ 1.4.0.dev0, < 1.4.0.dev9

    Update to 1.3.6; Update to 1.4.0.dev9

Original sources

Check your server →