Vulnerability · Published Jul 13, 2026 · Assigned by VulDB

CVE-2026-15605wandb Artifact Integrity Validation hashutil.py ArtifactManifestEntry.download weak hash

Low 3.1

In plain English

A low-severity broken cryptography in wandb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)3.1Low

Exploit odds (30 days)0.2%top 85.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A security vulnerability has been detected in wandb 0.25.2.dev1. Affected is the function ArtifactManifestEntry.download in the library wandb/sdk/lib/hashutil.py of the component Artifact Integrity Validation. The manipulation leads to use of weak hash. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The pull request to fix this issue awaits acceptance.

Affected products (as reported)

Vendor	Product	Versions
n/a	wandb	0.25.2.dev1

Weakness: CWE-328, CWE-327 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R

References

VDB-378114 | wandb Artifact Integrity Validation hashutil.py ArtifactManifestEntry.download weak hash vdb-entry, technical-description
VDB-378114 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-15605 | CVE Analysis and Report third-party-advisory
Submit #855675 | Weights & Biases wandb 0.25.2.dev1 at commit 28cc0bf5a9b529b72e5e501d0a48c6c42220ae0a; earlier versions may be affected if they use the same MD5-based CWE-328 Use of Weak Hash third-party-advisory
https://github.com/wandb/wandb/issues/12030 issue-tracking
https://github.com/wandb/wandb/pull/12031 issue-tracking, patch
https://github.com/wandb/wandb/ product