CVE-2026-68508 Hydra: hydra.utils.instantiate with untrusted config can lead to code execution
Attackers can execute arbitrary code by passing untrusted configuration to hydra.utils.instantiate, affecting applications using this Python library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-68508?
CVE-2026-68508 is a high-severity code injection vulnerability in facebookresearch hydra, published on 21 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.4, hydra.utils.instantiate() resolves and calls Python objects selected by configuration through _resolve_target() in hydra/_internal/instantiate/_instantiate2.py, allowing attacker-controlled target values and arguments to choose dangerous callables. A consuming application, library, CLI workflow, or model loader that passes untrusted configuration, CLI overrides, or model metadata into hydra.utils.instantiate() can therefore execute arbitrary code in its own process, including reading or modifying files and credentials or terminating the process. Version 1.3.4 adds target blocking with an explicit HYDRA_INSTANTIATE_ALLOWLIST_OVERRIDE escape hatch. This issue is fixed in version 1.3.4.
Which versions are affected by CVE-2026-68508?
3 open source packages ship an affected version, including hydra-core.
| Package | Affected | Fixed in |
|---|---|---|
hydra-core PyPI | All versions | 1.3.4 |
hydra-core PyPI | All versions | 1.3.4 |
hydra-core PyPI | All versions | 1.3.4 |
How do I fix CVE-2026-68508?
Upgrade hydra-core to 1.3.4 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-68508 being exploited?
There is no known exploitation of CVE-2026-68508 in the wild and no public exploit code.
Sources
Also known as GHSA-2cp2-2r3c-7p7r, PYSEC-2026-3850.