Vulnerability · Published Jun 3, 2026 · Assigned by VulDB

CVE-2026-10766mlrun DataFrame Hash helpers.py mlrun.utils.helpers.calculate_dataframe_hash weak hash

Low 3.6

In plain English

A low-severity broken cryptography in mlrun. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 0% of all known vulnerabilities).

Severity (CVSS 3.1)3.6Low

Exploit odds (30 days)<0.1%top 99.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in mlrun up to 1.12.0-rc3. This impacts the function mlrun.utils.helpers.calculate_dataframe_hash of the file mlrun/utils/helpers.py of the component DataFrame Hash Handler. The manipulation leads to use of weak hash. The attack can only be performed from a local environment. The complexity of an attack is rather high. The exploitability is said to be difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	mlrun	no fix listed	GHSA-phx2-3w66-h4pw
PyPI	mlrun	no fix listed	PYSEC-2026-3487

Affected products (as reported)

Vendor	Product	Versions
n/a	mlrun	1.12.0-rc11.12.0-rc21.12.0-rc3

Weakness: CWE-328, CWE-327 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R

References

VDB-368136 | mlrun DataFrame Hash helpers.py mlrun.utils.helpers.calculate_dataframe_hash weak hash vdb-entry, technical-description
VDB-368136 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-10766 | CVE Analysis and Report third-party-advisory
Submit #831419 | mlrun v1.12.0-rc3 Hash Collision third-party-advisory
https://github.com/mlrun/mlrun/issues/9691 exploit, issue-tracking
https://github.com/mlrun/mlrun/pull/9692 issue-tracking, patch
https://github.com/mlrun/mlrun/ product