Read the docs
TI-2026-68891 Aliases CVE-2026-106439GHSA-mwj6-rfh8-7qf4

Mutable policy state in Hydra allows blocklist bypass

Priority HIGH 72CWE-470Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-693.

Summary

Hydra from 1.3.4 before 1.3.7 and from 1.4.0.dev4 before 1.4.0.dev10 keeps its legacy instantiate target blocklists in mutable module-level state, which lets externally controlled input select code to run (CWE-470). An attacker who controls multiple sibling target entries can use instantiate() to remove a denied target from that state and then invoke it, which can run code with the application's privileges.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

Hydra is a framework for elegantly configuring complex applications. From 1.3.4 until 1.3.7 and 1.4.0.dev10, Hydra stores legacy instantiate target blocklists and related execution-policy collections in mutable module-level state. An attacker who controls multiple sibling target entries can resolve hydra._internal.target_policy.UNCONTROLLED_EXECUTION_TARGETS.discard through instantiate(), remove a denied target, and then invoke that target because sibling nodes are processed in insertion order against the same modified policy. The mutation persists in process-global state and can enable code execution with the application's privileges, while a narrow execution whitelist supplied by trusted Python code is not bypassed by the reported direct mutation path. This issue is fixed in versions 1.3.7 and 1.4.0.dev10.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00457 39th percentileScored 2026-11-07
Fix Fixed hydra (hydra-ecosystem): 1.3.7, 1.4.0.dev10hydra-core (PyPI): 1.3.7, 1.4.0.dev10Red Hat: 4 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
hydra-ecosystemhydra1.3.4 to before 1.3.7; 1.4.0.dev4 to before 1.4.0.dev101.3.7, 1.4.0.dev10Patch availableCNA
—hydra-core (PyPI)1.3.4 to before 1.3.71.3.7Patch availableGHSA-mwj6-rfh8-7qf4
—hydra-core (PyPI)1.4.0.dev4 to before 1.4.0.dev101.4.0.dev10Patch availableGHSA-mwj6-rfh8-7qf4
  • hydra Vendorhydra-ecosystem Affected 1.3.4 to before 1.3.7; 1.4.0.dev4 to before 1.4.0.dev10 Fixed in 1.3.7, 1.4.0.dev10 Patch available CNA
  • hydra-core (PyPI) Vendor— Affected 1.3.4 to before 1.3.7 Fixed in 1.3.7 Patch available GHSA-mwj6-rfh8-7qf4
  • hydra-core (PyPI) Vendor— Affected 1.4.0.dev4 to before 1.4.0.dev10 Fixed in 1.4.0.dev10 Patch available GHSA-mwj6-rfh8-7qf4

Remediation

Upgrade hydra-core to 1.3.7 or 1.4.0.dev10. Red Hat fixes this in RHSA-2026:82415 and RHSA-2026:82368 for Red Hat AI Inference Server 3.5 and in RHSA-2026:92452 and RHSA-2026:92449 for Red Hat Enterprise Linux AI 3.5. The sources list no fixed version for hydra.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA hydra (hydra-ecosystem) Fixed in 1.3.7, 1.4.0.dev10
  • Fix · GHSA-mwj6-rfh8-7qf4 hydra-core (PyPI) Fixed in 1.3.7 Advisory →
  • Fix · GHSA-mwj6-rfh8-7qf4 hydra-core (PyPI) Fixed in 1.4.0.dev10 Advisory →

Red Hat 4 advisories

  • RHSA-2026:92452 Released 2026-10-29 · Red Hat rating Critical
    Red Hat Enterprise Linux AI 3.5.2 enhancement update
    • Red Hat Enterprise Linux AI 3.5 registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9 +3
  • RHSA-2026:92449 Released 2026-10-29 · Red Hat rating Critical
    Red Hat Enterprise Linux AI 3.5.2 enhancement update
    • Red Hat Enterprise Linux AI 3.5 registry.redhat.io/rhelai3/disk-image-cuda-rhel9
  • RHSA-2026:82415 Released 2026-10-13 · Red Hat rating Critical
    Red Hat AI Inference 3.5.2 (cpu)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-cpu-rhel9
Show 1 more Red Hat advisories
  • RHSA-2026:82368 Released 2026-10-13 · Red Hat rating Critical
    Red Hat AI Inference 3.5.2 (cuda)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-cuda-rhel9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat AI Inference Server 3.5Fixed RHSA-2026:82368, RHSA-2026:82415
Red Hat Enterprise Linux AI 3.5Fixed RHSA-2026:92449, RHSA-2026:92452
Not affected: 2 products
  • Red Hat AI Inference Server
  • Red Hat Enterprise Linux AI 3.5

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-106439
  2. 2026-10-07 CISA SSVC decision points changed
  3. 2026-10-07 Priority changed: MEDIUM → HIGH
  4. 2026-10-07 Affected versions changed · Red Hat
  5. 2026-10-07 CVSS score added · Red Hat
  6. 2026-10-07 Alias added: GHSA-mwj6-rfh8-7qf4
  7. 2026-10-07 Fix available: PyPI/[email protected], PyPI/[email protected] · GHSA-mwj6-rfh8-7qf4
  8. 2026-10-07 CVSS score added · GHSA-mwj6-rfh8-7qf4
  9. 2026-10-07 Weakness changed · GHSA-mwj6-rfh8-7qf4
  10. 2026-10-07 6 new references · GHSA-mwj6-rfh8-7qf4
  11. 2026-10-14 Fix available: RHSA-2026:82368 · Red Hat
  12. 2026-10-14 Fix available: RHSA-2026:82415 · Red Hat
  13. 2026-10-15 Fix available: Red Hat AI Inference Server 3.5 · Red Hat
  14. 2026-10-21 Affected versions changed · Red Hat
  15. 2026-10-30 Fix available: RHSA-2026:92452 · Red Hat
  16. 2026-10-30 Fix available: RHSA-2026:92449 · Red Hat
  17. 2026-10-30 Fix available: Red Hat Enterprise Linux AI 3.5 · Red Hat

References

Advisory 1

Other 5

  • TI-2026-68892 Hydra Optuna sweeper executes untrusted callables from configuration CVSS 3.1HIGH 7.8
  • TI-2026-68894 Hydra instantiate() blacklist bypass allows code execution CVSS 3.1HIGH 7.8
  • TI-2026-68893 Hydra logging configuration lets attackers invoke importable classes CVSS 3.1HIGH 7.8
  • TI-2026-79750 Arbitrary module import in hydra-ray-launcher CVSS 4.0MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences