{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.12.0rc3"}],"component":"mlrun","cve_ids":["CVE-2026-10766"],"ecosystem":"PyPI","epss":0.00075,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-phx2-3w66-h4pw","id":"tcs_01M5KH5KPFE11C2DFR2REREAHT","modified_at":"2026-07-23T15:00:15.476005511Z","published_at":"2026-07-23T11:41:37.839535Z","references":["https://osv.dev/vulnerability/PYSEC-2026-3487","https://nvd.nist.gov/vuln/detail/CVE-2026-10766","https://github.com/mlrun/mlrun/issues/9691","https://github.com/mlrun/mlrun/pull/9692","https://github.com/mlrun/mlrun","https://vuldb.com/cve/CVE-2026-10766","https://vuldb.com/submit/831419","https://vuldb.com/vuln/368136","https://vuldb.com/vuln/368136/cti","https://pypi.org/project/mlrun","https://github.com/advisories/GHSA-phx2-3w66-h4pw"],"severity":{"label":"low","score":3.6},"sources":[{"source":"osv","source_id":"PYSEC-2026-3487","url":"https://osv.dev/vulnerability/PYSEC-2026-3487"}],"summary":"mlrun: DataFrame hash collisions can cause dataset artifact path conflicts and silent data corruption"}