CVE-2026-106441High· 7.8▾ TwilightHydra is a framework for elegantly configuring complex applications. Prior to 1.3.6 and 1.4.0.dev9, Hydra passes Python logging configuration to logging.config.dictConfig() without applying Hydra's target policy to handler class values o…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.6 and 1.4.0.dev9, Hydra passes Python logging configuration to logging.config.dictConfig() without applying Hydra's target policy to handler class values or formatter, filter, handler, queue, and listener factories. An attacker who controls Hydra logging configuration can therefore select an importable class or factory and cause it to be invoked with the application's privileges, even in versions where instantiate() is protected because the logging path does not use instantiate(). This issue is fixed in versions 1.3.6 and 1.4.0.dev9.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
hydra-core < 1.3.6hydra-core >= 1.4.0.dev0, < 1.4.0.dev9Patched in:
hydra-core 1.3.6hydra-core 1.4.0.dev9Source: https://github.com/advisories/GHSA-c3wx-c55w-pxjq
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-106439High· 8.5Hydra is a framework for elegantly configuring complex applications
CVE-2026-106442High· 7.8Hydra is a framework for elegantly configuring complex applications
CVE-2026-68508High· 7.8Hydra is a framework for elegantly configuring complex applications
CVE-2026-106440High· 7.8Hydra is a framework for elegantly configuring complex applications
CVE-2026-58659High· 7.8PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the _load_state function that imports and executes attacker-controlled module names from checkpoint _instantiator hyperparameters…
CVE-2026-105782High· 7.5Scrapy is a high-level web crawling and scraping framework for Python