CVE-2026-106439 Hydra: Mutable instantiate policy sets allow target blocklist bypass
Attackers can bypass execution policy blocklists in Hydra by mutating global state, enabling arbitrary code execution with application privileges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-106439?
CVE-2026-106439 is a high-severity vulnerability in hydra-ecosystem hydra, published on 6 Oct 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Hydra is a framework for elegantly configuring complex applications. From 1.3.4 until 1.3.7 and 1.4.0.dev10, Hydra stores legacy instantiate target blocklists and related execution-policy collections in mutable module-level state. An attacker who controls multiple sibling target entries can resolve hydra._internal.target_policy.UNCONTROLLED_EXECUTION_TARGETS.discard through instantiate(), remove a denied target, and then invoke that target because sibling nodes are processed in insertion order against the same modified policy. The mutation persists in process-global state and can enable code execution with the application's privileges, while a narrow execution whitelist supplied by trusted Python code is not bypassed by the reported direct mutation path. This issue is fixed in versions 1.3.7 and 1.4.0.dev10.
Which versions are affected by CVE-2026-106439?
5 open source packages ship an affected version, including hydra-core.
| Package | Affected | Fixed in |
|---|---|---|
hydra-core PyPI | From 1.3.4 | 1.3.7, 1.4.0.dev10 |
hydra-core PyPI | From 1.3.4 | 1.3.7 |
hydra-core PyPI | From 1.3.4 | 1.3.7 |
hydra-core PyPI | From 1.4.0.dev4 | 1.4.0.dev10 |
hydra-core PyPI | From 1.4.0.dev4 | 1.4.0.dev10 |
How do I fix CVE-2026-106439?
Upgrade hydra-core to a fixed version for your release line: 1.3.7 or 1.4.0.dev10.
Is CVE-2026-106439 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-106439 exists.
Sources
Also known as GHSA-mwj6-rfh8-7qf4, PYSEC-2026-4222.