RCE in Facebookresearch Hydra
CVE-2026-68508
Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.4, hydra.utils.instantiate() resolves and calls Python objects selected by configuration through _resolve_target() in hydra/_internal/instantiate/_instantiate2.py, allowing attacker-controlled target values and arguments to choose dangerous callables. A consuming application, library, CLI workflow, or model loader that passes untrusted configuration, CLI overrides, or model metadata into hydra.utils.instantiate() can therefore execute arbitrary code in its own process, including reading or modifying files and credentials or terminating the process. Version 1.3.4 adds target blocking with an explicit HYDRA_INSTANTIATE_ALLOWLIST_OVERRIDE escape hatch. This issue is fixed in version 1.3.4.
Vulnerability class: RCE (Remote Code Execution)
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Facebookresearch Hydra — versions < 1.3.4
Weakness classification (CWE)
References
- https://github.com/hydra-ecosystem/hydra/security/advisories/GHSA-2cp2-2r3c-7p7r (x_refsource_CONFIRM)
- https://github.com/hydra-ecosystem/hydra/issues/3259 (x_refsource_MISC)
- https://github.com/hydra-ecosystem/hydra/pull/3261 (x_refsource_MISC)
- https://github.com/hydra-ecosystem/hydra/commit/7faad0dcedfb4c0a364aa1067c0080fd6fdf8dca (x_refsource_MISC)
- https://github.com/hydra-ecosystem/hydra/releases/tag/v1.3.4 (x_refsource_MISC)
Frequently asked questions
- What is CVE-2026-68508?
- CVE-2026-68508 is a high-severity vulnerability in Facebookresearch Hydra, classified under Code Injection. CVSS score: 7.8/10. Published 2026-08-21.
- How severe is CVE-2026-68508?
- High severity. CVSS v3 base score is 7.8 out of 10.