Description
Hydra is a framework for elegantly configuring complex applications. From 1.3.4 until 1.3.6 and 1.4.0.dev9, the instantiate() target blacklist introduced for CVE-2026-68508 incompletely checks the effective callable selected by the target field. Execution wrappers such as timeit.timeit, executable deserialization through pickle.loads, aliases, callable-returning helpers, generic dispatch, and deferred calls can obscure or defer the effective target and bypass name-based authorization. An attacker who causes an application to instantiate untrusted Hydra configuration can use these gaps to execute code with the application's privileges. This issue is fixed in versions 1.3.6 and 1.4.0.dev9.
Published: 2026-10-06
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

Hydra’s instantiate() target blacklist was intended to prevent certain callables from being used, but between versions 1.3.4 and 1.3.6 and 1.4.0.dev9 the check was incomplete. Execution wrappers such as timeit.timeit, deserialization through pickle.loads, aliasing, and other indirect invocation patterns can conceal the true target callable, allowing a malicious caller to bypass the blacklist and execute arbitrary code with the application’s privileges. The weakness is classified as CWE‑184 and CWE‑470.

Affected Systems

The Hydra framework produced by hydra‑ecosystem is affected. Vulnerable releases are 1.3.4 and 1.3.5. Any installation that accepts externally controlled Hydra configuration files is susceptible.

Risk and Exploitability

The CVSS score of 7.8 places the issue in the high‑severity range. The EPSS score is < 1%, and the vulnerability is not listed in CISA KEV. Attackers must supply or force the application to load untrusted Hydra configuration files; this configuration injection can trigger the bypass, leading to code execution with the application’s privileges. The impact is significant, as exploitation allows full control over the target system.

Generated by OpenCVE AI on October 8, 2026 at 14:17 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Hydra to version 1.3.6 or later, which corrects the target blacklist logic and prevents indirect callable execution.
  • Restrict the source of Hydra configuration files; ensure they are only changed by trusted, signed, or otherwise authenticated administrators and enforce strict permissions on the configuration files.
  • Audit any use of Hydra.instantiate() that accepts untrusted input and, if upgrade is delayed, implement an application‑level whitelist of permissible callables to block unintended executions.

Generated by OpenCVE AI on October 8, 2026 at 14:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-rqx7-p7vv-w7hr Hydra instantiate target blacklist bypasses permit code execution
History

Fri, 09 Oct 2026 09:15:00 +0000

Type Values Removed Values Added
First Time appeared Hydra-ecosystem
Hydra-ecosystem hydra
Vendors & Products Hydra-ecosystem
Hydra-ecosystem hydra

Thu, 08 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-470
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 07 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description Hydra is a framework for elegantly configuring complex applications. From 1.3.4 until 1.3.6 and 1.4.0.dev9, the instantiate() target blacklist introduced for CVE-2026-68508 incompletely checks the effective callable selected by the target field. Execution wrappers such as timeit.timeit, executable deserialization through pickle.loads, aliases, callable-returning helpers, generic dispatch, and deferred calls can obscure or defer the effective target and bypass name-based authorization. An attacker who causes an application to instantiate untrusted Hydra configuration can use these gaps to execute code with the application's privileges. This issue is fixed in versions 1.3.6 and 1.4.0.dev9.
Title Hydra instantiate target blacklist bypasses permit code execution
Weaknesses CWE-184
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Hydra-ecosystem Hydra
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-07T14:14:08.296Z

Reserved: 2026-10-06T16:49:40.590Z

Link: CVE-2026-106442

cve-icon Vulnrichment

Updated: 2026-10-07T14:13:22.931Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-06T19:18:13.170

Modified: 2026-10-07T15:17:11.900

Link: CVE-2026-106442

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-06T18:55:49Z

Links: CVE-2026-106442 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-09T08:43:00Z

Weaknesses
  • CWE-184

    Incomplete List of Disallowed Inputs

  • CWE-470

    Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')