Description
A security vulnerability has been detected in wandb 0.25.2.dev1. Affected is the function ArtifactManifestEntry.download in the library wandb/sdk/lib/hashutil.py of the component Artifact Integrity Validation. The manipulation leads to use of weak hash. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The pull request to fix this issue awaits acceptance.
Published: 2026-07-13
Score: 2.3 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is located in the wandb artifact handling component, specifically the ArtifactManifestEntry.download method in hashutil.py. It allows an attacker to manipulate a manifest entry so that a weak hash algorithm is used during integrity verification. It is inferred that this manipulation could allow tampered artifacts to bypass integrity checks. The weakness involves the use of weak hash functions (CWE‑327 and CWE‑328).

Affected Systems

The affected product is the wandb SDK version 0.25.2.dev1. Users employing this SDK for artifact handling, particularly those relying on artifact integration, are impacted.

Risk and Exploitability

The CVSS score is 2.3, indicating a low overall impact. The EPSS score is < 1 %, showing a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack may be initiated remotely but requires a high degree of complexity and is described as difficult to exploit. Therefore, while a potential integrity breach exists, its overall risk remains low under current conditions.

Generated by OpenCVE AI on July 31, 2026 at 11:04 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Monitor the wandb GitHub repository for the merged pull request that includes the fix and upgrade to the released version once it is available.
  • Keep the wandb SDK up to date by applying new releases promptly after the fix is available.
  • Limit artifact sources to trusted repositories and enforce manual verification of artifact integrity. If the integrity of artifacts is critical, consider disabling artifact integrity validation or substituting a more secure hash verification process until the patch is applied.

Generated by OpenCVE AI on July 31, 2026 at 11:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 15 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Low

Tue, 14 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 13 Jul 2026 23:00:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in wandb 0.25.2.dev1. Affected is the function ArtifactManifestEntry.download in the library wandb/sdk/lib/hashutil.py of the component Artifact Integrity Validation. The manipulation leads to use of weak hash. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The pull request to fix this issue awaits acceptance.
Title wandb Artifact Integrity Validation hashutil.py ArtifactManifestEntry.download weak hash
First Time appeared Wandb
Wandb wandb
Weaknesses CWE-327
CWE-328
CPEs cpe:2.3:a:wandb:wandb:*:*:*:*:*:*:*:*
Vendors & Products Wandb
Wandb wandb
References
Metrics cvssV2_0

{'score': 2.1, 'vector': 'AV:N/AC:H/Au:S/C:P/I:N/A:N/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.1, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R'}

cvssV4_0

{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Wandb Wandb
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-14T12:42:47.147Z

Reserved: 2026-07-13T15:38:12.267Z

Link: CVE-2026-15605

cve-icon Vulnrichment

Updated: 2026-07-14T12:42:35.344Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Low

Publid Date: 2026-07-13T22:45:09Z

Links: CVE-2026-15605 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T11:15:05Z

Weaknesses
  • CWE-327

    Use of a Broken or Risky Cryptographic Algorithm

  • CWE-328

    Use of Weak Hash