CVE-2026-106442: Hydra-core Target Blacklist Bypass Leading to Code Execution
Summary
CVE-2026-106442: Hydra instantiate target blacklist bypasses permit code execution. Affects hydra-core across 2 version ranges.
>= 1.3.4, < 1.3.6
>= 1.4.0.dev0, < 1.4.0.dev9
Fixed in 1.3.6 or 1.4.0.dev9, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hydra-core is a popular open-source framework for elegantly configuring and managing complex applications in Python. It allows users to define configurations in a structured manner, enabling dynamic instantiation of components. However, its flexibility can lead to security vulnerabilities if not properly managed, particularly in how it handles untrusted configurations.
Vulnerability Detail
The vulnerability arises from an incomplete target blacklist in Hydra's instantiate() API, which allows attackers to execute arbitrary code by exploiting execution wrappers and deserialization methods. This can occur when an untrusted configuration is instantiated, leading to potential code execution with the application's privileges. The issue was identified as a bypass of the security measures introduced in CVE-2026-68508, making it critical for users to address.
How To Fix
Latest published version: 1.4.0.dev10 as of 23 Oct 2026
pip install --upgrade "hydra-core==1.4.0.dev10"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.3.4, < 1.3.61.3.6pip install --upgrade "hydra-core==1.3.6" -
>= 1.4.0.dev0, < 1.4.0.dev91.4.0.dev9pip install --upgrade "hydra-core==1.4.0.dev9"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, users of Hydra 1.3 should avoid instantiating configurations from untrusted sources. For those using Hydra 1.4 and later, it is recommended to constrain untrusted configurations with a narrow execution whitelist supplied by trusted Python code.
Conclusion
CVE-2026-106442 presents a significant security risk for users of the Hydra-core framework due to its potential for arbitrary code execution through untrusted configurations. It is crucial for users to upgrade to the patched versions to mitigate this risk effectively.
See every vulnerability recorded for hydra-core →
FAQ
CVE-2026-106442 is a vulnerability in the Hydra-core framework that allows attackers to bypass target blacklists and execute arbitrary code through untrusted configurations.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The main risk is that an attacker could execute arbitrary code with the application's privileges, potentially leading to data breaches or system compromise.
If an immediate upgrade is not possible, avoid using untrusted configurations and consider implementing a temporary execution whitelist.
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for hydra-core.
