Read the docs
TI-2026-68894 Aliases CVE-2026-106442GHSA-rqx7-p7vv-w7hr

Hydra instantiate() blacklist bypass allows code execution

Priority LOW 35CWE-184Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

The hydra-core package on PyPI from 1.3.4 before 1.3.6 and from 1.4.0.dev0 before 1.4.0.dev9 is affected. The instantiate() target blacklist checks the effective callable incompletely, so wrappers, aliases and deferred calls can hide the real target (CWE-184). An attacker who can make an application instantiate untrusted Hydra configuration can execute code with that application's privileges.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

Hydra is a framework for elegantly configuring complex applications. From 1.3.4 until 1.3.6 and 1.4.0.dev9, the instantiate() target blacklist introduced for CVE-2026-68508 incompletely checks the effective callable selected by the target field. Execution wrappers such as timeit.timeit, executable deserialization through pickle.loads, aliases, callable-returning helpers, generic dispatch, and deferred calls can obscure or defer the effective target and bypass name-based authorization. An attacker who causes an application to instantiate untrusted Hydra configuration can use these gaps to execute code with the application's privileges. This issue is fixed in versions 1.3.6 and 1.4.0.dev9.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00161 5th percentileScored 2026-11-07
Fix Fixed hydra (hydra-ecosystem): 1.3.6, 1.4.0.dev9hydra-core (PyPI): 1.3.6, 1.4.0.dev9Red Hat: 4 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
hydra-ecosystemhydra1.3.4 to before 1.3.6; 1.4.0.dev0 to before 1.4.0.dev91.3.6, 1.4.0.dev9Patch availableCNA
—hydra-core (PyPI)1.3.4 to before 1.3.61.3.6Patch availableGHSA-rqx7-p7vv-w7hr
—hydra-core (PyPI)1.4.0.dev0 to before 1.4.0.dev91.4.0.dev9Patch availableGHSA-rqx7-p7vv-w7hr
  • hydra Vendorhydra-ecosystem Affected 1.3.4 to before 1.3.6; 1.4.0.dev0 to before 1.4.0.dev9 Fixed in 1.3.6, 1.4.0.dev9 Patch available CNA
  • hydra-core (PyPI) Vendor— Affected 1.3.4 to before 1.3.6 Fixed in 1.3.6 Patch available GHSA-rqx7-p7vv-w7hr
  • hydra-core (PyPI) Vendor— Affected 1.4.0.dev0 to before 1.4.0.dev9 Fixed in 1.4.0.dev9 Patch available GHSA-rqx7-p7vv-w7hr

Remediation

Upgrade hydra-core to 1.3.6 or 1.4.0.dev9. Red Hat fixes Red Hat AI Inference Server 3.5 and Red Hat Enterprise Linux AI 3.5 in advisories RHSA-2026:82368, RHSA-2026:82415, RHSA-2026:92449 and RHSA-2026:92452. The sources list no fixed version for hydra.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA hydra (hydra-ecosystem) Fixed in 1.3.6, 1.4.0.dev9
  • Fix · GHSA-rqx7-p7vv-w7hr hydra-core (PyPI) Fixed in 1.3.6 Advisory →
  • Fix · GHSA-rqx7-p7vv-w7hr hydra-core (PyPI) Fixed in 1.4.0.dev9 Advisory →

Red Hat 4 advisories

  • RHSA-2026:92452 Released 2026-10-29 · Red Hat rating Critical
    Red Hat Enterprise Linux AI 3.5.2 enhancement update
    • Red Hat Enterprise Linux AI 3.5 registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9 +3
  • RHSA-2026:92449 Released 2026-10-29 · Red Hat rating Critical
    Red Hat Enterprise Linux AI 3.5.2 enhancement update
    • Red Hat Enterprise Linux AI 3.5 registry.redhat.io/rhelai3/disk-image-cuda-rhel9
  • RHSA-2026:82415 Released 2026-10-13 · Red Hat rating Critical
    Red Hat AI Inference 3.5.2 (cpu)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-cpu-rhel9
Show 1 more Red Hat advisories
  • RHSA-2026:82368 Released 2026-10-13 · Red Hat rating Critical
    Red Hat AI Inference 3.5.2 (cuda)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-cuda-rhel9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat AI Inference Server 3.5Fixed RHSA-2026:82368, RHSA-2026:82415
Red Hat Enterprise Linux AI 3.5Fixed RHSA-2026:92449, RHSA-2026:92452
Not affected: 2 products
  • Red Hat AI Inference Server
  • Red Hat Enterprise Linux AI 3.5

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-106442
  2. 2026-10-07 CISA SSVC decision points changed
  3. 2026-10-07 Priority changed: MEDIUM → LOW
  4. 2026-10-07 Alias added: GHSA-rqx7-p7vv-w7hr
  5. 2026-10-07 Fix available: PyPI/[email protected], PyPI/[email protected] · GHSA-rqx7-p7vv-w7hr
  6. 2026-10-07 CVSS score added · GHSA-rqx7-p7vv-w7hr
  7. 2026-10-07 Weakness changed · GHSA-rqx7-p7vv-w7hr
  8. 2026-10-07 8 new references · GHSA-rqx7-p7vv-w7hr
  9. 2026-10-08 Affected versions changed · Red Hat
  10. 2026-10-08 CVSS score added · Red Hat
  11. 2026-10-14 Fix available: RHSA-2026:82368 · Red Hat
  12. 2026-10-14 Fix available: RHSA-2026:82415 · Red Hat
  13. 2026-10-15 Fix available: Red Hat AI Inference Server 3.5 · Red Hat
  14. 2026-10-21 Affected versions changed · Red Hat
  15. 2026-10-30 Fix available: RHSA-2026:92452 · Red Hat
  16. 2026-10-30 Fix available: RHSA-2026:92449 · Red Hat
  17. 2026-10-30 Fix available: Red Hat Enterprise Linux AI 3.5 · Red Hat

References

Advisory 1

Other 7

  • TI-2026-68891 Mutable policy state in Hydra allows blocklist bypass CVSS 4.0HIGH 8.5
  • TI-2026-68892 Hydra Optuna sweeper executes untrusted callables from configuration CVSS 3.1HIGH 7.8
  • TI-2026-68893 Hydra logging configuration lets attackers invoke importable classes CVSS 3.1HIGH 7.8
  • TI-2026-79750 Arbitrary module import in hydra-ray-launcher CVSS 4.0MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences