EUVD-2026-93658
GHSA-mwj6-rfh8-7qf4
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Config is untrusted input requiring no privileges (PR:N) but the app must load/process the malicious local config (AV:L, UI:R); mutation yields full code execution, so C/I/A:H.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Hydra is a framework for elegantly configuring complex applications. From 1.3.4 until 1.3.7 and 1.4.0.dev10, Hydra stores legacy instantiate target blocklists and related execution-policy collections in mutable module-level state. An attacker who controls multiple sibling target entries can resolve hydra._internal.target_policy.UNCONTROLLED_EXECUTION_TARGETS.discard through instantiate(), remove a denied target, and then invoke that target because sibling nodes are processed in insertion order against the same modified policy. The mutation persists in process-global state and can enable code execution with the application's privileges, while a narrow execution whitelist supplied by trusted Python code is not bypassed by the reported direct mutation path. This issue is fixed in versions 1.3.7 and 1.4.0.dev10.
Articles & Coverage 1
AnalysisAI
Code execution with the hosting application's privileges is possible in Hydra 1.3.4 through versions before 1.3.7 (and before 1.4.0.dev10) when an attacker controls multiple sibling target entries in a configuration that the application passes to instantiate(). One sibling resolves hydra._internal.target_policy.UNCONTROLLED_EXECUTION_TARGETS.discard to delete a denied target from Hydra's process-global blocklist, and a later sibling - processed in insertion order against the same mutated policy - invokes the now-permitted callable; the mutation persists for the life of the process. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the application to call instantiate() on a Hydra configuration whose sibling target entries are attacker-controlled: one sibling must resolve hydra._internal.target_policy.UNCONTROLLED_EXECUTION_TARGETS.discard to remove a denied target from the module-level (process-global) blocklist, and a later sibling - relying on insertion-order processing against that same mutated policy - must invoke the now-permitted target. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P, score 8.5) describes a local, low-complexity flaw with high confidentiality, integrity and availability impact on the vulnerable system (VC/VI/VA:H) but no subsequent-system scope change. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Hydra to 1.3.7 or 1.4.0.dev10, which convert the execution-policy collections to immutable frozensets, relocate the policy to hydra/_internal/execution_policy.py and add context-scoped policy handling; the vendor advisory is at https://github.com/hydra-ecosystem/hydra/security/advisories/GHSA-mwj6-rfh8-7qf4 and the release is https://github.com/hydra-ecosystem/hydra/releases/tag/v1.3.7, with the principal fix commits at https://github.com/hydra-ecosystem/hydra/commit/0dd18084589a3d3e577d1f1a8a48fb485c94a5e6 and https://github.com/hydra-ecosystem/hydra/commit/4720dfca2bde27fa140ec287a05709668fbdf168. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Hydra deployments and confirm whether any run versions 1.3.4 through versions before 1.3.7 or before 1.4.0.dev10, then identify and stop any flow of untrusted configuration content into hydra.utils.instantiate(); restrict those workloads to trusted configs and least-privilege service accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Share
External POC / Exploit Code
Leaving vuln.today