CVE-2026-106441
7.8 HIGHpublic exploit availablePublished 2026-10-06 · Updated 2026-10-07
AI risk analysis
- Summary
- Hydra framework allows attackers to inject arbitrary Python classes into logging configuration, potentially leading to remote code execution through logging handlers and formatters. This vulnerability affects versions prior to 1.3.6 and 1.4.0.dev9 where logging configuration bypasses Hydra's security policies.
- Exploitability
- Moderately difficult to exploit as it requires an attacker to control Hydra's logging configuration, but can be achieved through configuration files or API endpoints that accept logging settings.
- Blast radius
- High impact in environments where Hydra is used for application configuration and attackers can influence logging configurations, potentially leading to full system compromise.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to version 1.3.6 or 1.4.0.dev9 to fix the logging configuration vulnerability.
Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.6 and 1.4.0.dev9, Hydra passes Python logging configuration to logging.config.dictConfig() without applying Hydra's target policy to handler class values or formatter, filter, handler, queue, and listener factories. An attacker who controls Hydra logging configuration can therefore select an importable class or factory and cause it to be invoked with the application's privileges, even in versions where instantiate() is protected because the logging path does not use instantiate(). This issue is fixed in versions 1.3.6 and 1.4.0.dev9.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-94
Public exploit & PoC references
- https://github.com/hydra-ecosystem/hydra/commit/76bfc30ce1f3105416941dd2e3a562568e369120
- https://github.com/hydra-ecosystem/hydra/commit/ff3e4dba890c29a21d8c2bb867ee87d37ccf21d0
- https://github.com/hydra-ecosystem/hydra/pull/3420
- https://github.com/hydra-ecosystem/hydra/security/advisories/GHSA-c3wx-c55w-pxjq
All references
- https://github.com/hydra-ecosystem/hydra/commit/76bfc30ce1f3105416941dd2e3a562568e369120
- https://github.com/hydra-ecosystem/hydra/commit/ff3e4dba890c29a21d8c2bb867ee87d37ccf21d0
- https://github.com/hydra-ecosystem/hydra/pull/3420
- https://github.com/hydra-ecosystem/hydra/security/advisories/GHSA-c3wx-c55w-pxjq
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-93348PoC
- HIGHCVE-2026-106440PoC
- HIGHCVE-2026-100864PoC
- HIGHCVE-2026-100865PoC
- HIGHCVE-2026-104851PoC
- CRITICALCVE-2026-105135PoC
- CRITICALCVE-2026-105812
- HIGHCVE-2026-108375PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.