CVE-2026-106439

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: GitHub, Inc.

Description

Hydra is a framework for elegantly configuring complex applications. From 1.3.4 until 1.3.7 and 1.4.0.dev10, Hydra stores legacy instantiate target blocklists and related execution-policy collections in mutable module-level state. An attacker who controls multiple sibling target entries can resolve hydra._internal.target_policy.UNCONTROLLED_EXECUTION_TARGETS.discard through instantiate(), remove a denied target, and then invoke that target because sibling nodes are processed in insertion order against the same modified policy. The mutation persists in process-global state and can enable code execution with the application's privileges, while a narrow execution whitelist supplied by trusted Python code is not bypassed by the reported direct mutation path. This issue is fixed in versions 1.3.7 and 1.4.0.dev10.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-06

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106439

EUVD

EUVD-2026-93658

Affected Vendors & Products

Vendor	Product	Version / Range
hydra-ecosystem	hydra	>= 1.3.4, < 1.3.7
hydra-ecosystem	hydra	>= 1.4.0.dev4, < 1.4.0.dev10

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
CWE-470	The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

Attack-Flow Graph

Executive Summary

Hydra versions 1.3.4 to 1.3.7 and 1.4.0.dev10 have a vulnerability where mutable module-level state stores legacy target blocklists. An attacker controlling sibling target entries can manipulate the execution policy via instantiate(), remove denied targets, and execute restricted code with the application's privileges. This bypasses a trusted whitelist due to process-global state mutation.

Detection Guidance

This vulnerability affects Hydra versions between 1.3.4 and 1.3.7 and 1.4.0.dev10. Detection involves checking installed Hydra versions and reviewing application code for unsafe usage of instantiate(). No specific network commands are provided in the context.

Impact Analysis

This vulnerability allows attackers to execute arbitrary code with the privileges of the Hydra application. If you use affected versions, an attacker could bypass security controls, gain unauthorized access, or perform actions outside intended restrictions.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially violating data protection requirements under GDPR or HIPAA by enabling access to or manipulation of sensitive data. Compliance may be compromised if attackers exploit this to exfiltrate or alter protected information.

Mitigation Strategies

Upgrade Hydra to version 1.3.7 or 1.4.0.dev10 or later to fix the vulnerability. Avoid using vulnerable versions in production.

Hi! I’m here to help you understand CVE-2026-106439. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70