Weak Hash Usage in wandb Artifact Integrity Validation

Executive Summary

CVE-2026-15605 is a security vulnerability in the wandb library version 0.25.2.dev1. The issue lies in the ArtifactManifestEntry.download function within the wandb/sdk/lib/hashutil.py component, which is responsible for artifact integrity validation.

The vulnerability involves the use of a weak hash algorithm (MD5) for verifying the integrity of artifacts. MD5 is known to be susceptible to collision attacks, where an attacker could potentially substitute malicious content that produces the same hash as the original, legitimate artifact. This could allow the attacker to bypass integrity checks and introduce unauthorized or harmful data into the system.

The attack can be initiated remotely, but it requires a high degree of complexity and is considered difficult to exploit. A fix has been proposed in a pull request (PR #12031) to replace MD5 with SHA-256, a more secure hashing algorithm, while maintaining backward compatibility with existing artifacts.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking the version of the wandb library in use and verifying the integrity of artifact downloads. Since the vulnerability involves weak hash usage (MD5) in the ArtifactManifestEntry.download function, you can inspect the wandb library version and look for signs of improper integrity validation.

• Check the installed version of wandb: Run 'pip show wandb' or 'pip list | grep wandb' to verify if the version is 0.25.2.dev1, which is affected.
• Inspect artifact manifests: If you have access to artifact manifests, check if they rely solely on MD5 hashes for integrity validation. SHA-256 hashes should be present for secure validation.
• Monitor artifact downloads: If possible, log or inspect the hashes used during artifact downloads to confirm whether SHA-256 is being prioritized over MD5.

There are no specific network-based detection methods for this vulnerability, as it is a local integrity validation issue. However, ensuring the use of updated versions of wandb with SHA-256 support is critical.

Useful 0 Not Useful 0

Impact Analysis

If you are using wandb 0.25.2.dev1, this vulnerability could impact you in the following ways:

• Integrity compromise: An attacker could substitute malicious artifacts that appear legitimate due to the weak hash validation, leading to the execution or processing of unauthorized or harmful data.
• Data corruption: If artifacts are used to store or transfer critical data (e.g., machine learning models, datasets), the vulnerability could result in corrupted or tampered data being accepted as valid.
• Security bypass: The vulnerability could be exploited to bypass security controls that rely on artifact integrity, potentially allowing unauthorized access or actions within your environment.

The CVSS v3.1 base score for this vulnerability is 3.1 (Low), indicating limited impact, but the specific consequences depend on how you use wandb artifacts in your workflows.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could affect compliance with common standards and regulations in the following ways:

• GDPR (General Data Protection Regulation): If wandb artifacts contain personal data, the vulnerability could lead to unauthorized access or tampering, violating GDPR requirements for data integrity and confidentiality (Articles 5, 32). This could result in non-compliance and potential fines.
• HIPAA (Health Insurance Portability and Accountability Act): For organizations handling protected health information (PHI), the vulnerability could compromise the integrity of artifacts containing PHI, violating HIPAA's Security Rule (45 CFR Part 164, Subpart C), which mandates safeguards for electronic PHI.
• Other standards: Compliance with frameworks like ISO 27001, NIST SP 800-53, or SOC 2 may also be impacted, as these require controls for data integrity and secure handling of sensitive information. Weak hashing could be seen as a failure to implement adequate technical safeguards.

While the direct impact depends on the specific use case, organizations should assess whether their use of wandb artifacts involves sensitive or regulated data and take steps to mitigate the vulnerability to maintain compliance.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, follow these steps:

• Upgrade wandb: Update to the latest version of wandb that includes the fix for this vulnerability. The fix is available in pull request #12031, which introduces SHA-256 checksums for artifact integrity validation.
• Avoid using affected versions: If upgrading is not immediately possible, avoid using wandb version 0.25.2.dev1, as it is confirmed to be vulnerable.
• Verify artifact integrity manually: If you must use an affected version, manually verify the integrity of downloaded artifacts using SHA-256 hashes where possible.
• Monitor for updates: Keep an eye on the official wandb GitHub repository for any security advisories or patches related to this issue.

Useful 0 Not Useful 0