CVE-2026-106439
2 advisories.
PyPI/hydra-core CVE-2026-106439: high, EPSS 0.46%
Hydra: Mutable instantiate policy sets allow target blocklist bypass
Action: Upgrade hydra-core to 1.3.7 or later.
pip install hydra-core==1.3.7pip install hydra-core==1.4.0.dev10Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.3.4 | 1.3.7 | - |
| 1.4.0.dev4 | - | - |
Fixed versions
| 1.3.7 | 1.4.0.dev10 |
Sources
- osv: GHSA-mwj6-rfh8-7qf4
- https://github.com/hydra-ecosystem/hydra/security/advisories/GHSA-mwj6-rfh8-7qf4
- https://nvd.nist.gov/vuln/detail/CVE-2026-106439
- https://github.com/hydra-ecosystem/hydra/commit/0dd18084589a3d3e577d1f1a8a48fb485c94a5e6
- https://github.com/hydra-ecosystem/hydra/commit/4720dfca2bde27fa140ec287a05709668fbdf168
- https://github.com/hydra-ecosystem/hydra
- https://github.com/hydra-ecosystem/hydra/releases/tag/v1.3.7
CVE-2026-106439 · published · modified · JSON
PyPI/hydra-core CVE-2026-106439: unknown, EPSS 0.46%
Hydra: Mutable instantiate policy sets allow target blocklist bypass
Action: Upgrade hydra-core to 1.3.7 or later.
pip install hydra-core==1.3.7pip install hydra-core==1.4.0.dev10Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.3.4 | 1.3.7 | - |
| 1.4.0.dev4 | - | - |
Fixed versions
| 1.3.7 | 1.4.0.dev10 |
Sources
- osv: PYSEC-2026-4222
- https://github.com/hydra-ecosystem/hydra/security/advisories/GHSA-mwj6-rfh8-7qf4
- https://nvd.nist.gov/vuln/detail/CVE-2026-106439
- https://github.com/hydra-ecosystem/hydra/commit/0dd18084589a3d3e577d1f1a8a48fb485c94a5e6
- https://github.com/hydra-ecosystem/hydra/commit/4720dfca2bde27fa140ec287a05709668fbdf168
- https://github.com/hydra-ecosystem/hydra
- https://github.com/hydra-ecosystem/hydra/releases/tag/v1.3.7
- https://pypi.org/project/hydra-core
- https://github.com/advisories/GHSA-mwj6-rfh8-7qf4
CVE-2026-106439 · published · modified · JSON