{"cve":"CVE-2026-106441","nvd":{"published":"2026-10-06T19:18:13.020","modified":"2026-10-07T19:17:32.150","status":"Awaiting Analysis","description":"Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.6 and 1.4.0.dev9, Hydra passes Python logging configuration to logging.config.dictConfig() without applying Hydra's target policy to handler class values or formatter, filter, handler, queue, and listener factories. An attacker who controls Hydra logging configuration can therefore select an importable class or factory and cause it to be invoked with the application's privileges, even in versions where instantiate() is protected because the logging path does not use instantiate(). This issue is fixed in versions 1.3.6 and 1.4.0.dev9.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":7.8},"cwes":["CWE-94"],"references":["https://github.com/hydra-ecosystem/hydra/commit/76bfc30ce1f3105416941dd2e3a562568e369120","https://github.com/hydra-ecosystem/hydra/commit/ff3e4dba890c29a21d8c2bb867ee87d37ccf21d0","https://github.com/hydra-ecosystem/hydra/pull/3420","https://github.com/hydra-ecosystem/hydra/security/advisories/GHSA-c3wx-c55w-pxjq"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:58:01.639778232+00:00"},"epss":{"cve":"CVE-2026-106441","score":0.00165,"percentile":0.0573,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-c3wx-c55w-pxjq","url":"https://osv.dev/vulnerability/GHSA-c3wx-c55w-pxjq","summary":"Hydra logging configuration permits unsafe callable resolution","modified":"2026-10-15T14:55:50.399421541Z","packages":[{"ecosystem":"PyPI","name":"hydra-core","purl":"pkg:pypi/hydra-core","ranges":["<1.3.6"],"fixed":["1.3.6"]},{"ecosystem":"PyPI","name":"hydra-core","purl":"pkg:pypi/hydra-core","ranges":[">=1.4.0.dev0 <1.4.0.dev9"],"fixed":["1.4.0.dev9"]}]},{"id":"PYSEC-2026-4221","url":"https://osv.dev/vulnerability/PYSEC-2026-4221","summary":"Hydra logging configuration permits unsafe callable resolution","modified":"2026-10-15T14:45:04.402255647Z","packages":[{"ecosystem":"PyPI","name":"hydra-core","purl":"pkg:pypi/hydra-core","ranges":["<1.3.6",">=1.4.0.dev0 <1.4.0.dev9"],"fixed":["1.3.6","1.4.0.dev9"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}