CVE-2026-106441

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-07

Assigner: GitHub, Inc.

Description

Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.6 and 1.4.0.dev9, Hydra passes Python logging configuration to logging.config.dictConfig() without applying Hydra's target policy to handler class values or formatter, filter, handler, queue, and listener factories. An attacker who controls Hydra logging configuration can therefore select an importable class or factory and cause it to be invoked with the application's privileges, even in versions where instantiate() is protected because the logging path does not use instantiate(). This issue is fixed in versions 1.3.6 and 1.4.0.dev9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106441

EUVD

EUVD-2026-93664

Affected Vendors & Products

Vendor	Product	Version / Range
hydra-ecosystem	hydra	< 1.3.6
hydra-ecosystem	hydra	>= 1.4.0.dev0, < 1.4.0.dev9

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

Hydra is a framework for configuring applications. Prior to versions 1.3.6 and 1.4.0.dev9, it passes Python logging configuration to logging.config.dictConfig() without applying Hydra's target policy to handler classes or formatter, filter, handler, queue, and listener factories. An attacker controlling Hydra logging configuration can select an importable class or factory to execute code with the application's privileges, bypassing protections in instantiate().

Detection Guidance

This vulnerability can be detected by checking the installed version of Hydra. If you are running a version prior to 1.3.6 or 1.4.0.dev9, your system is vulnerable. Use commands like 'pip show hydra-core' or 'hydra --version' to check the version.

Impact Analysis

This vulnerability allows an attacker to execute arbitrary code with the privileges of the application using Hydra. This could lead to data theft, system compromise, or unauthorized access to sensitive information. Systems using affected Hydra versions are at risk if logging configuration is controlled by untrusted sources.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection requirements and HIPAA's security rules. Organizations may face legal penalties, reputational damage, and loss of compliance certifications if exploited.

Mitigation Strategies

Immediately upgrade Hydra to version 1.3.6 or 1.4.0.dev9 or later. If upgrading is not possible, review and restrict access to Hydra logging configuration files to prevent unauthorized modifications.

Hi! I’m here to help you understand CVE-2026-106441. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70