CVE-2026-15605

wandb Artifact Integrity Validation hashutil.py ArtifactManifestEntry.download weak hash

View on CVE.org
Published Jul 13, 2026 CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Description
A security vulnerability has been detected in wandb 0.25.2.dev1. Affected is the function ArtifactManifestEntry.download in the library wandb/sdk/lib/hashutil.py of the component Artifact Integrity Validation. The manipulation leads to use of weak hash. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The pull request to fix this issue awaits acceptance.

Analysis

AI-generated

Technical impact

The vulnerability is located in the wandb artifact handling component, specifically the ArtifactManifestEntry.download method in hashutil.py. It allows an attacker to manipulate a manifest entry so that a weak hash algorithm is used during integrity verification. It is inferred that this manipulation could allow tampered artifacts to bypass integrity checks. The weakness involves the use of weak hash functions (CWE‑327 and CWE‑328).

Affected Systems

The affected product is the wandb SDK version 0.25.2.dev1. Users employing this SDK for artifact handling, particularly those relying on artifact integration, are impacted.

Risk and Exploitability

The CVSS score is 2.3, indicating a low overall impact. The EPSS score is < 1 %, showing a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack may be initiated remotely but requires a high degree of complexity and is described as difficult to exploit. Therefore, while a potential integrity breach exists, its overall risk remains low under current conditions.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Monitor the wandb GitHub repository for the merged pull request that includes the fix and upgrade to the released version once it is available.
  • Keep the wandb SDK up to date by applying new releases promptly after the fix is available.
  • Limit artifact sources to trusted repositories and enforce manual verification of artifact integrity. If the integrity of artifacts is critical, consider disabling artifact integrity validation or substituting a more secure hash verification process until the patch is applied.

Generated by OpenCVE AI on July 31, 2026 at 11:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Low
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A security vulnerability has been detected in wandb 0.25.2.dev1. Affected is the function ArtifactManifestEntry.download in the library wandb/sdk/lib/hashutil.py of the component Artifact Integrity Validation. The manipulation leads to use of weak hash. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The pull request to fix this issue awaits acceptance.
Title wandb Artifact Integrity Validation hashutil.py ArtifactManifestEntry.download weak hash
First Time appeared Wandb
Wandb wandb
Weaknesses CWE-327
CWE-328
CPEs cpe:2.3:a:wandb:wandb:*:*:*:*:*:*:*:*
Vendors & Products Wandb
Wandb wandb
References
Metrics cvssV2_0

{'score': 2.1, 'vector': 'AV:N/AC:H/Au:S/C:P/I:N/A:N/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.1, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R'}

cvssV4_0

{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X'}
Weaknesses
  • CWE-327

    Use of a Broken or Risky Cryptographic Algorithm

  • CWE-328

    Use of Weak Hash

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Jul 14, 2026, 12:42 PM
Reserved
Jul 13, 2026, 3:38 PM

View source JSON

Updated
Jul 14, 2026, 12:42 PM

JSON

Status
Deferred
Published
Jul 13, 2026, 11:16 PM
Modified
Jul 14, 2026, 3:26 PM

View source JSON

Severity
Low
Public date
Jul 13, 2026, 10:45 PM

View source Bugzilla JSON

Updated
Sep 29, 2026, 8:00 AM

JSON