Detections
Analytics

SCA: security update for hydra-core (GHSA-2cp2-2r3c-7p7r)

high Tenable Cloud Security Plugin ID 446233

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.4,
 hydra.utils.instantiate() resolves and calls Python objects selected by configuration through
 _resolve_target() in hydra/_internal/instantiate/_instantiate2.py, allowing attacker-controlled target
 values and arguments to choose dangerous callables. A consuming application, library, CLI workflow, or
 model loader that passes untrusted configuration, CLI overrides, or model metadata into
 hydra.utils.instantiate() can therefore execute arbitrary code in its own process, including reading or
 modifying files and credentials or terminating the process. Version 1.3.4 adds target blocking with an
 explicit HYDRA_INSTANTIATE_ALLOWLIST_OVERRIDE escape hatch. This issue is fixed in version 1.3.4.
 (CVE-2026-68508)

Solution

Update the hydra-core library and its related packages to version 1.3.4 or later.

See Also

https://github.com/advisories/GHSA-2cp2-2r3c-7p7r

Plugin Details

Severity: High

ID: 446233

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 8/22/2026

Updated: 8/22/2026

Risk Information

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-68508

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/21/2026

Vulnerability Publication Date: 8/21/2026

Reference Information

CVE: CVE-2026-68508