Hydra

CVE-2026-68508 Aug 21, 20:09 PyPI HIGH PATCH GHSA This Week

Arbitrary code execution in Facebook Research Hydra prior to version 1.3.4 allows any party who can supply untrusted configuration - including YAML config files, CLI overrides, or ML model metadata - to invoke dangerous Python callables through hydra.utils.instantiate(). The vulnerability stems from _resolve_target() accepting any Python callable path without restriction, enabling an attacker to trigger functions such as os.system, subprocess.Popen, or builtins.exec inside the consuming application's process. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists; the upstream fix is confirmed shipped in v1.3.4.

CVE-2025-54864 Aug 12, 16:15 MEDIUM PATCH This Month

Hydra is a continuous integration service for Nix based projects. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authentication for Critical Function vulnerability could allow attackers to access critical functionality without authentication.

CVE-2025-54800 Aug 12, 16:15 HIGH PATCH This Month

Hydra is a continuous integration service for Nix based projects. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2025-32435 Apr 15, 23:15 LOW PATCH Monitor

Hydra is a Continuous Integration service for Nix based projects. Rated low severity (CVSS 2.6), this vulnerability is remotely exploitable.

CVE-2024-45049 Aug 27, 21:15 HIGH PATCH This Week

Hydra is a Continuous Integration service for Nix based projects. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authentication for Critical Function vulnerability could allow attackers to access critical functionality without authentication.

CVE-2024-32657 Apr 22, 23:15 MEDIUM PATCH This Month

Hydra is a Continuous Integration service for Nix based projects. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2023-42449 Oct 04, 20:15 HIGH POC This Week

Hydra is the two-layer scalability solution for Cardano. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-42448 Oct 04, 19:15 HIGH PATCH This Week

Hydra is the layer-two scalability solution for Cardano. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.

CVE-2023-38701 Oct 04, 19:15 CRITICAL POC Act Now

Hydra is the layer-two scalability solution for Cardano. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-42806 Sep 21, 17:15 MEDIUM This Month

Hydra is the layer-two scalability solution for Cardano. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2020-5300 Apr 06, 17:15 Go MEDIUM PATCH This Month

In Hydra (an OAuth2 Server and OpenID Certified™ OpenID Connect Provider written in Go), before version 1.4.0+oryOS.17, when using client authentication method 'private_key_jwt' [1], OpenId. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable.

CVE-2019-17502 Oct 12, 20:15 HIGH POC This Week

Hydra through 0.1.8 has a NULL pointer dereference and daemon crash when processing POST requests that lack a Content-Length header. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2019-8400 Feb 17, 06:29 Go MEDIUM POC PATCH This Month

ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error error_hint parameter. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.