Read the docs
TI-2026-09272 Aliases CVE-2026-10804GHSA-vqwp-45wm-r9r5

Streamlit Palette hashing.py weak hash

Priority MEDIUM 44CWE-327Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
None · Low · Low
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-327.

Summary

A vulnerability has been found in Streamlit up to 1.53.0. Impacted is an unknown function in the library lib/streamlit/runtime/caching/hashing.py of the component Palette Handler. Such manipulation leads to use of weak hash. Local access is required to approach this attack. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00083 0th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Partial streamlit (PyPI): 1.53.1Red Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Streamlit1.0; 1.1; 1.2; 1.3; 1.4; 1.5; 1.6; 1.7; 1.8; 1.9; 1.10; 1.11; 1.12; 1.13; 1.14; 1.15; 1.16; 1.17; 1.18; 1.19; 1.20; 1.21; 1.22; 1.23; 1.24; 1.25; 1.26; 1.27; 1.28; 1.29; 1.30; 1.31; 1.32; 1.33; 1.34; 1.35; 1.36; 1.37; 1.38; 1.39; 1.40; 1.41; 1.42; 1.43; 1.44; 1.45; 1.46; 1.47; 1.48; 1.49; 1.50; 1.51; 1.52; 1.53.0—No fix listedCNA
—streamlit (PyPI)before 1.53.11.53.1Patch availableGHSA-vqwp-45wm-r9r5
  • Streamlit Vendor— Affected 1.0; 1.1; 1.2; 1.3; 1.4; 1.5; 1.6; 1.7; 1.8; 1.9; 1.10; 1.11; 1.12; 1.13; 1.14; 1.15; 1.16; 1.17; 1.18; 1.19; 1.20; 1.21; 1.22; 1.23; 1.24; 1.25; 1.26; 1.27; 1.28; 1.29; 1.30; 1.31; 1.32; 1.33; 1.34; 1.35; 1.36; 1.37; 1.38; 1.39; 1.40; 1.41; 1.42; 1.43; 1.44; 1.45; 1.46; 1.47; 1.48; 1.49; 1.50; 1.51; 1.52; 1.53.0 Fixed in — No fix listed CNA
  • streamlit (PyPI) Vendor— Affected before 1.53.1 Fixed in 1.53.1 Patch available GHSA-vqwp-45wm-r9r5

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:snowflake:streamlit:*:*:*:*:*:*:*:*up to 1.53.0VulnerableSnowflake
  • cpe:2.3:a:snowflake:streamlit:*:*:*:*:*:*:*:* Versions up to 1.53.0 Vulnerable ·Snowflake

Remediation

  • Fix · GHSA-vqwp-45wm-r9r5 streamlit (PyPI) Fixed in 1.53.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-10804
  2. 2026-10-03 Alias added: GHSA-vqwp-45wm-r9r5

References

Exploit 1

Patch 1

Advisory 1

Other 5

  • TI-2022-16345 Streamlit directory traversal vulnerability CVSS 3.1MEDIUM 6.5
  • TI-2024-28442 Streamlit Path Traversal Security Vulnerability on Windows CVSS 3.1MEDIUM 6.5
  • TI-2023-12222 Streamlit Cross-site Scripting vulnerability CVSS 3.1MEDIUM 6.1
  • TI-2026-26062 Streamlit on Windows has Unauthenticated SSRF Vulnerability (NTLM Credential Exposure) CVSS 3.1MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences