CVE-2026-106441: Hydra-core Logging Configuration Vulnerability Allows Unsafe Callable Resolution
Summary
CVE-2026-106441: Hydra logging configuration permits unsafe callable resolution. Affects hydra-core across 2 version ranges.
< 1.3.6
>= 1.4.0.dev0, < 1.4.0.dev9
Fixed in 1.3.6 or 1.4.0.dev9, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hydra-core is a powerful framework designed for managing complex applications and configurations in Python. It provides a flexible and dynamic way to configure applications, allowing users to compose configurations from various sources. However, a recent vulnerability has been identified in its logging configuration, which can potentially allow attackers to execute arbitrary code if they can manipulate the logging settings.
Vulnerability Detail
The vulnerability arises from Hydra's use of Python's logging configuration, which is passed to logging.config.dictConfig(). This method can resolve and invoke importable classes and factories specified in the configuration, including handlers and formatters. The critical issue is that this logging resolution was not controlled by Hydra's target policy, allowing an attacker with control over the logging configuration to execute code with the application's privileges. This poses a significant security risk, as it can lead to unauthorized access and manipulation of the application.
How To Fix
Latest published version: 1.4.0.dev10 as of 23 Oct 2026
pip install --upgrade "hydra-core==1.4.0.dev10"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.3.61.3.6pip install --upgrade "hydra-core==1.3.6" -
>= 1.4.0.dev0, < 1.4.0.dev91.4.0.dev9pip install --upgrade "hydra-core==1.4.0.dev9"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, users of Hydra 1.3 should avoid composing logging configurations from untrusted sources. For Hydra 1.4 and later, it is advisable to constrain custom logging targets using a narrow execution whitelist defined by trusted Python code. This can be done by specifying the allowed callables in the configuration.
Conclusion
The vulnerability CVE-2026-106441 in Hydra-core poses a significant risk due to its potential for allowing arbitrary code execution through manipulated logging configurations. Users are strongly advised to upgrade to the latest versions and implement recommended security measures to mitigate this risk.
See every vulnerability recorded for hydra-core →
FAQ
CVE-2026-106441 is a vulnerability in the Hydra-core framework that allows unsafe callable resolution through its logging configuration, potentially enabling code execution by attackers.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can allow attackers to execute arbitrary code with the application's privileges, leading to unauthorized access and potential data breaches.
Upgrade to Hydra version 1.3.6 or later, and for Hydra 1.4, ensure you are using version 1.4.0.dev9 or later. Implement an execution whitelist for custom logging targets.
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for hydra-core.
