wandb CVE-2026-15605

Exploitation requires all of the following: (1) the target deployment uses wandb 0.25.2.dev1 or another version where ArtifactManifestEntry.download performs integrity validation using MD5 only, without the SHA-256 supplementary check from PR #12031; (2) the attacker has either write access to the artifact storage backend (e.g., object storage bucket) or a man-in-the-middle network position between the wandb client and storage service, per CVSS AV:N; (3) the attacker holds at minimum a low-privilege wandb account or credential sufficient to interact with the artifact system, per CVSS PR:L - unauthenticated exploitation is not supported by the available vector data; (4) the attacker can generate a valid MD5 collision for the target file, a computationally expensive operation per CVSS AC:H. Limiting factors: the affected version is a development pre-release with limited production deployment; MD5 collision attacks require substantial compute resources; and storage or network access prerequisites exclude opportunistic or bulk attackers.

The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) scores 2.3, reflecting two major exploitation barriers: high attack complexity (MD5 collision generation is computationally expensive and requires specialized tooling) and a requirement for low-privilege authenticated access. Notably, the provided vector marks VI:N (no integrity impact), which is incongruent with the CWE-328 classification and the nature of the flaw - a successful attack fundamentally enables file substitution, an integrity violation. This appears to understate the real-world impact class; security teams should treat the effective integrity risk as Low rather than None. No EPSS data was provided, and no CISA KEV listing or public exploit code exists, confirming this has not been operationalized. The affected version is a development pre-release (0.25.2.dev1), which materially limits the number of production deployments exposed. For ML pipelines relying on artifact provenance for model governance or supply-chain security, the conceptual risk is higher than the score suggests, but the practical exploitation barrier remains significant absent a motivated, well-resourced adversary with storage or network access.

An attacker with write access to a wandb artifact storage bucket identifies a target ML model artifact registered in a wandb project. Using offline MD5 chosen-prefix collision tooling, the attacker crafts a malicious model weights file that produces the same MD5 base64 digest as the legitimate artifact. The attacker replaces the file in storage; when a downstream pipeline calls ArtifactManifestEntry.download(), the MD5-only integrity check passes and the malicious file is accepted without raising an error. No public exploit code exists for this specific vulnerability, and the MD5 collision computation requirement limits this to well-resourced adversaries.