Log in Start free

Vulnerability · Published Oct 6, 2026 · Assigned by GitHub_M

CVE-2026-106442Hydra instantiate target blacklist bypasses permit code execution

High 7.8

In plain English

A high-severity security flaw in hydra from hydra-ecosystem. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 94.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Hydra is a framework for elegantly configuring complex applications. From 1.3.4 until 1.3.6 and 1.4.0.dev9, the instantiate() target blacklist introduced for CVE-2026-68508 incompletely checks the effective callable selected by the target field. Execution wrappers such as timeit.timeit, executable deserialization through pickle.loads, aliases, callable-returning helpers, generic dispatch, and deferred calls can obscure or defer the effective target and bypass name-based authorization. An attacker who causes an application to instantiate untrusted Hydra configuration can use these gaps to execute code with the application's privileges. This issue is fixed in versions 1.3.6 and 1.4.0.dev9.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIhydra-core1.3.6GHSA-rqx7-p7vv-w7hr
PyPIhydra-core1.4.0.dev9GHSA-rqx7-p7vv-w7hr
PyPIhydra-core1.3.6, 1.4.0.dev9PYSEC-2026-4223

Affected products (as reported)

VendorProductVersions
hydra-ecosystem hydra >= 1.3.4, < 1.3.6>= 1.4.0.dev0, < 1.4.0.dev9

Weakness: CWE-184 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References