EUVD-2026-93665
GHSA-rqx7-p7vv-w7hr
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attacker needs no privileges (PR:N) but the app must process attacker-influenced config (UI:R, AV:L); successful bypass yields full code execution, so C:H/I:H/A:H.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
5DescriptionCVE.org
Hydra is a framework for elegantly configuring complex applications. From 1.3.4 until 1.3.6 and 1.4.0.dev9, the instantiate() target blacklist introduced for CVE-2026-68508 incompletely checks the effective callable selected by the target field. Execution wrappers such as timeit.timeit, executable deserialization through pickle.loads, aliases, callable-returning helpers, generic dispatch, and deferred calls can obscure or defer the effective target and bypass name-based authorization. An attacker who causes an application to instantiate untrusted Hydra configuration can use these gaps to execute code with the application's privileges. This issue is fixed in versions 1.3.6 and 1.4.0.dev9.
Articles & Coverage 1
AnalysisAI
Hydra 1.3.4 through 1.3.5 and the 1.4.0.dev line prior to 1.4.0.dev9 can execute attacker-chosen code when an application runs Hydra's instantiate() on configuration an attacker can influence, because the callable blacklist added for CVE-2026-68508 is name-based and can be sidestepped via wrappers, aliases, dispatch helpers, or deferred invocation. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 7.8) indicates no attacker privileges are required but a victim application must actually instantiate untrusted or externally sourced config, which is why user interaction is scored; the flaw is CWE-184 (Incomplete List of Disallowed Inputs) and is best understood as an incomplete fix rather than a new class of bug. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim application to call Hydra's instantiate() on configuration that an attacker can influence, in affected versions 1.3.4 up to 1.3.6 (and the 1.4.0.dev line before 1.4.0.dev9). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine remote-code-execution-class flaw (CWE-184, Incomplete List of Disallowed Inputs) representing an incomplete fix for the earlier CVE-2026-68508 blacklist bypass, confirmed by vendor source-code evidence (commit diffs expanding the blocklist with CALLBACK_DISPATCH_TARGETS, CALLABLE_WRAPPER_TARGETS, and UNCONTROLLED_EXECUTION_TARGETS). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to the vendor-released fixed versions Hydra 1.3.6 or 1.4.0.dev9 (the advisory is GHSA-rqx7-p7vv-w7hr and the release tag is github.com/hydra-ecosystem/hydra/releases/tag/v1.3.6; the hardening commits are 2c82bbb3f39603b336cb852461739fdf7a38798a and f462811117b5ecfd2ed652ed52d6b4e3771bd943, delivered via PR 3412 and PR 3413). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all applications and environments using Hydra 1.3.4, 1.3.5, or any 1.4.0.dev release prior to 1.4.0.dev9; identify any use of instantiate() on configuration that is not developer-authored and trusted; and apply vendor-released patches by upgrading to Hydra 1.3.6 or 1.4.0.dev9, or isolate affected services if immediate upgrade is not possible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-184 – Incomplete List of Disallowed Inputs
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today