CVE-2026-106442
2 advisories.
PyPI/hydra-core CVE-2026-106442: high 7.8, EPSS 0.16%
Hydra instantiate target blacklist bypasses permit code execution
Action: Upgrade hydra-core to 1.3.6 or later.
pip install hydra-core==1.3.6pip install hydra-core==1.4.0.dev9Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.3.4 | 1.3.6 | - |
| 1.4.0.dev0 | 1.4.0.dev9 | - |
Fixed versions
| 1.3.6 | 1.4.0.dev9 |
Sources
- osv: GHSA-rqx7-p7vv-w7hr
- https://github.com/hydra-ecosystem/hydra/security/advisories/GHSA-rqx7-p7vv-w7hr
- https://nvd.nist.gov/vuln/detail/CVE-2026-106442
- https://github.com/hydra-ecosystem/hydra/pull/3412
- https://github.com/hydra-ecosystem/hydra/pull/3413
- https://github.com/hydra-ecosystem/hydra/commit/2c82bbb3f39603b336cb852461739fdf7a38798a
- https://github.com/hydra-ecosystem/hydra/commit/f462811117b5ecfd2ed652ed52d6b4e3771bd943
- https://github.com/hydra-ecosystem/hydra
- https://github.com/hydra-ecosystem/hydra/releases/tag/v1.3.6
CVE-2026-106442 · published · modified · JSON
PyPI/hydra-core CVE-2026-106442: high 7.8, EPSS 0.16%
Hydra instantiate target blacklist bypasses permit code execution
Action: Upgrade hydra-core to 1.3.6 or later.
pip install hydra-core==1.3.6pip install hydra-core==1.4.0.dev9Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.3.4 | 1.3.6 | - |
| 1.4.0.dev0 | 1.4.0.dev9 | - |
Fixed versions
| 1.3.6 | 1.4.0.dev9 |
Sources
- osv: PYSEC-2026-4223
- https://github.com/hydra-ecosystem/hydra/security/advisories/GHSA-rqx7-p7vv-w7hr
- https://nvd.nist.gov/vuln/detail/CVE-2026-106442
- https://github.com/hydra-ecosystem/hydra/pull/3412
- https://github.com/hydra-ecosystem/hydra/pull/3413
- https://github.com/hydra-ecosystem/hydra/commit/2c82bbb3f39603b336cb852461739fdf7a38798a
- https://github.com/hydra-ecosystem/hydra/commit/f462811117b5ecfd2ed652ed52d6b4e3771bd943
- https://github.com/hydra-ecosystem/hydra
- https://github.com/hydra-ecosystem/hydra/releases/tag/v1.3.6
- https://pypi.org/project/hydra-core
- https://github.com/advisories/GHSA-rqx7-p7vv-w7hr
CVE-2026-106442 · published · modified · JSON