Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.6 and 1.4.0.dev9, Hydra passes Python logging configuration to logging.config.dictConfig() without applying Hydra's target policy to handler class values or formatter, filter, handler, queue, and listener factories. An attacker who controls Hydra logging configuration can therefore select an importable class or factory and cause it to be invoked with the application's privileges, even in versions where instantiate() is protected because the logging path does not use instantiate(). This issue is fixed in versions 1.3.6 and 1.4.0.dev9.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.6 and 1.4.0.dev9, Hydra
    passes Python logging configuration to logging.config.dictConfig() without applying Hydra's target policy
    to handler class values or formatter, filter, handler, queue, and listener factories. An attacker who
    controls Hydra logging configuration can therefore select an importable class or factory and cause it to
    be invoked with the application's privileges, even in versions where instantiate() is protected because
    the logging path does not use instantiate(). This issue is fixed in versions 1.3.6 and 1.4.0.dev9.
    (CVE-2026-106441)

ID	Name	Product	Family	Type	Severity
476085	Chainguard: multiple nemo-rl-cuda-13.0 packages: security update to 0.7.0-r4	Tenable Cloud Security	Chainguard Local Security Checks	Local	high
476085	Chainguard: multiple nemo-rl-cuda-13.0 packages: security update to 0.7.0-r4	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	high
473709	SCA: security update for hydra-core (GHSA-c3wx-c55w-pxjq)	Tenable Cloud Security	SCA Checks	Local	high
473709	SCA: security update for hydra-core (GHSA-c3wx-c55w-pxjq)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-106441

high

Tenable Plugins

high

high

high

high