Hydra
Monthly
Pending deposits in Cardano Hydra heads can be stolen by any third party who can observe the chain and submit a standard Cardano transaction. Versions prior to 2.1.0 ship a deposit validator (hydra-plutus/validators/deposit.ak, deployed via hydra-node <= 2.0.0) whose Claim branch only compares the deposit datum's head_id to the attacker-supplied redeemer currencySymbol and checks the transaction is before the deposit deadline; it never requires the Head state-token UTxO to be spent and never constrains outputs, so a standalone Claim transaction confirming before the deadline redirects the deposited assets to an arbitrary address. The attack is unauthenticated and needs no victim interaction, only a deposit in flight through POST /commit and not yet past its deadline (default three times depositPeriod, typically tens of minutes to hours); the vendor advisory publishes a full exploit walkthrough and devnet reproduction, and the flaw is fixed in 2.1.0. No CISA KEV listing is present in the supplied data.
Configuration-controlled code execution in the hydra-optuna-sweeper package (Hydra 1.2.0 up to but not including 1.3.0, plus 1.4.0 development builds before 1.4.0.dev10) allows an attacker who controls Optuna sweep configuration or command-line overrides to name an arbitrary importable Python callable in hydra.sweeper.custom_search_space that Hydra resolves and then invokes inside the controller process at the application's privilege level, including bypassing the trusted execution whitelist introduced on affected 1.4.0 development releases. The assessed CVSS 3.1 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8 High): delivery is local and unauthenticated, but a victim must actually launch the sweep, after which confidentiality, integrity, and availability impact is total for the affected process. Exploitation is only meaningful where sweep configuration or overrides cross a trust boundary; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Code execution with the hosting application's privileges is possible in Hydra 1.3.4 through versions before 1.3.7 (and before 1.4.0.dev10) when an attacker controls multiple sibling target entries in a configuration that the application passes to instantiate(). One sibling resolves hydra._internal.target_policy.UNCONTROLLED_EXECUTION_TARGETS.discard to delete a denied target from Hydra's process-global blocklist, and a later sibling - processed in insertion order against the same mutated policy - invokes the now-permitted callable; the mutation persists for the life of the process. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P, 8.5) indicates no privileges are required and only passive user interaction, and no public exploit identified at time of analysis (not in CISA KEV, no POC referenced); exploitation is limited to deployments that feed untrusted configuration content to instantiate(), and a narrow execution whitelist supplied by trusted Python code is not bypassed by the reported direct mutation path.
Arbitrary code execution in Facebook Research Hydra prior to version 1.3.4 allows any party who can supply untrusted configuration - including YAML config files, CLI overrides, or ML model metadata - to invoke dangerous Python callables through hydra.utils.instantiate(). The vulnerability stems from _resolve_target() accepting any Python callable path without restriction, enabling an attacker to trigger functions such as os.system, subprocess.Popen, or builtins.exec inside the consuming application's process. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists; the upstream fix is confirmed shipped in v1.3.4.
Hydra is a continuous integration service for Nix based projects. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authentication for Critical Function vulnerability could allow attackers to access critical functionality without authentication.
Hydra is a continuous integration service for Nix based projects. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Hydra is a Continuous Integration service for Nix based projects. Rated low severity (CVSS 2.6), this vulnerability is remotely exploitable.
Hydra is a Continuous Integration service for Nix based projects. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authentication for Critical Function vulnerability could allow attackers to access critical functionality without authentication.
Hydra is a Continuous Integration service for Nix based projects. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Hydra is the two-layer scalability solution for Cardano. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Hydra is the layer-two scalability solution for Cardano. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
Hydra is the layer-two scalability solution for Cardano. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Hydra is the layer-two scalability solution for Cardano. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In Hydra (an OAuth2 Server and OpenID Certified™ OpenID Connect Provider written in Go), before version 1.4.0+oryOS.17, when using client authentication method 'private_key_jwt' [1], OpenId. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable.
Hydra through 0.1.8 has a NULL pointer dereference and daemon crash when processing POST requests that lack a Content-Length header. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error error_hint parameter. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Pending deposits in Cardano Hydra heads can be stolen by any third party who can observe the chain and submit a standard Cardano transaction. Versions prior to 2.1.0 ship a deposit validator (hydra-plutus/validators/deposit.ak, deployed via hydra-node <= 2.0.0) whose Claim branch only compares the deposit datum's head_id to the attacker-supplied redeemer currencySymbol and checks the transaction is before the deposit deadline; it never requires the Head state-token UTxO to be spent and never constrains outputs, so a standalone Claim transaction confirming before the deadline redirects the deposited assets to an arbitrary address. The attack is unauthenticated and needs no victim interaction, only a deposit in flight through POST /commit and not yet past its deadline (default three times depositPeriod, typically tens of minutes to hours); the vendor advisory publishes a full exploit walkthrough and devnet reproduction, and the flaw is fixed in 2.1.0. No CISA KEV listing is present in the supplied data.
Configuration-controlled code execution in the hydra-optuna-sweeper package (Hydra 1.2.0 up to but not including 1.3.0, plus 1.4.0 development builds before 1.4.0.dev10) allows an attacker who controls Optuna sweep configuration or command-line overrides to name an arbitrary importable Python callable in hydra.sweeper.custom_search_space that Hydra resolves and then invokes inside the controller process at the application's privilege level, including bypassing the trusted execution whitelist introduced on affected 1.4.0 development releases. The assessed CVSS 3.1 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8 High): delivery is local and unauthenticated, but a victim must actually launch the sweep, after which confidentiality, integrity, and availability impact is total for the affected process. Exploitation is only meaningful where sweep configuration or overrides cross a trust boundary; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Code execution with the hosting application's privileges is possible in Hydra 1.3.4 through versions before 1.3.7 (and before 1.4.0.dev10) when an attacker controls multiple sibling target entries in a configuration that the application passes to instantiate(). One sibling resolves hydra._internal.target_policy.UNCONTROLLED_EXECUTION_TARGETS.discard to delete a denied target from Hydra's process-global blocklist, and a later sibling - processed in insertion order against the same mutated policy - invokes the now-permitted callable; the mutation persists for the life of the process. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P, 8.5) indicates no privileges are required and only passive user interaction, and no public exploit identified at time of analysis (not in CISA KEV, no POC referenced); exploitation is limited to deployments that feed untrusted configuration content to instantiate(), and a narrow execution whitelist supplied by trusted Python code is not bypassed by the reported direct mutation path.
Arbitrary code execution in Facebook Research Hydra prior to version 1.3.4 allows any party who can supply untrusted configuration - including YAML config files, CLI overrides, or ML model metadata - to invoke dangerous Python callables through hydra.utils.instantiate(). The vulnerability stems from _resolve_target() accepting any Python callable path without restriction, enabling an attacker to trigger functions such as os.system, subprocess.Popen, or builtins.exec inside the consuming application's process. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists; the upstream fix is confirmed shipped in v1.3.4.
Hydra is a continuous integration service for Nix based projects. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authentication for Critical Function vulnerability could allow attackers to access critical functionality without authentication.
Hydra is a continuous integration service for Nix based projects. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Hydra is a Continuous Integration service for Nix based projects. Rated low severity (CVSS 2.6), this vulnerability is remotely exploitable.
Hydra is a Continuous Integration service for Nix based projects. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authentication for Critical Function vulnerability could allow attackers to access critical functionality without authentication.
Hydra is a Continuous Integration service for Nix based projects. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Hydra is the two-layer scalability solution for Cardano. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Hydra is the layer-two scalability solution for Cardano. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
Hydra is the layer-two scalability solution for Cardano. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Hydra is the layer-two scalability solution for Cardano. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In Hydra (an OAuth2 Server and OpenID Certified™ OpenID Connect Provider written in Go), before version 1.4.0+oryOS.17, when using client authentication method 'private_key_jwt' [1], OpenId. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable.
Hydra through 0.1.8 has a NULL pointer dereference and daemon crash when processing POST requests that lack a Content-Length header. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error error_hint parameter. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.