CVE-2026-106442
CVE-2026-106442
Hydra is a framework for elegantly configuring complex applications. From 1.3.4 until 1.3.6 and 1.4.0.dev9, the instantiate() target blacklist introduced for CVE-2026-68508 incompletely checks the effective callable selected by the target field. Execution wrappers such as timeit.timeit, executable deserialization through pickle.loads, aliases, callable-returning helpers, generic dispatch, and deferred calls can obscure or defer the effective target and bypass name-based authorization. An attacker who causes an application to instantiate untrusted Hydra configuration can use these gaps to execute code with the application's privileges. This issue is fixed in versions 1.3.6 and 1.4.0.dev9.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Weakness classification (CWE)
References
- github.com/hydra-ecosystem/hydra/security/advisories/GHSA-rqx7-p7vv-w7hr
- github.com/hydra-ecosystem/hydra/pull/3412
- github.com/hydra-ecosystem/hydra/pull/3413
- github.com/hydra-ecosystem/hydra/commit/2c82bbb3f39603b336cb852461739fdf7a38798a
- github.com/hydra-ecosystem/hydra/commit/f462811117b5ecfd2ed652ed52d6b4e3771bd943
- github.com/hydra-ecosystem/hydra/releases/tag/v1.3.6
Frequently asked questions
- What is CVE-2026-106442?
- CVE-2026-106442 is a high-severity vulnerability, classified under Incomplete List of Disallowed Inputs. CVSS score: 7.8/10. Published 2026-10-06.
- How severe is CVE-2026-106442?
- High severity. CVSS v3 base score is 7.8 out of 10.