CVE-2026-106440

Published: Ott 06, 2026 Last Modified: Ott 06, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 7,8
Source: [email protected]
Attack Vector: local
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high

Description

AI Translation Available

Hydra is a framework for elegantly configuring complex applications. From 1.2.0 until 1.3.0 and 1.4.0.dev10, the hydra-optuna-sweeper package accepts a configuration-controlled dotted path in hydra.sweeper.custom_search_space, resolves it with hydra.utils.get_method(), and later invokes the returned callable in the Hydra controller process. Because get_method() is a trusted-input lookup helper and does not apply the execution policy used by instantiate(), an attacker who controls Optuna sweep configuration or command-line overrides can select importable Python code for execution with the application's privileges, including bypassing a trusted execution whitelist on affected Hydra 1.4 development releases. This issue is fixed in versions 1.3.0 and 1.4.0.dev10.

470

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Confidentiality Availability Other
Potential Impacts:
Execute Unauthorized Code Or Commands Alter Execution Logic Dos: Crash, Exit, Or Restart Other Read Application Data
Applicable Platforms
Languages: Java, PHP, Interpreted
View CWE Details
https://github.com/hydra-ecosystem/hydra/commit/0dd18084589…
https://github.com/hydra-ecosystem/hydra/commit/0dd18084589a3d3e577d1f1a8a48fb4…
https://github.com/hydra-ecosystem/hydra/commit/4720dfca2bd…
https://github.com/hydra-ecosystem/hydra/commit/4720dfca2bde27fa140ec287a057096…
https://github.com/hydra-ecosystem/hydra/releases/tag/v1.3.7
https://github.com/hydra-ecosystem/hydra/releases/tag/v1.3.7
https://github.com/hydra-ecosystem/hydra/security/advisorie…
https://github.com/hydra-ecosystem/hydra/security/advisories/GHSA-5jjj-9xc3-rm56