Detections
Analytics

SCA: security update for hydra-optuna-sweeper (GHSA-5jjj-9xc3-rm56)

high Tenable Cloud Security Plugin ID 473811

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Hydra is a framework for elegantly configuring complex applications. From 1.2.0 until 1.3.0 and
 1.4.0.dev10, the hydra-optuna-sweeper package accepts a configuration-controlled dotted path in
 hydra.sweeper.custom_search_space, resolves it with hydra.utils.get_method(), and later invokes the
 returned callable in the Hydra controller process. Because get_method() is a trusted-input lookup helper
 and does not apply the execution policy used by instantiate(), an attacker who controls Optuna sweep
 configuration or command-line overrides can select importable Python code for execution with the
 application's privileges, including bypassing a trusted execution whitelist on affected Hydra 1.4
 development releases. This issue is fixed in versions 1.3.0 and 1.4.0.dev10. (CVE-2026-106440)

Solution

Update the hydra-optuna-sweeper library and its related packages to version 1.3.0 or later.

See Also

https://github.com/advisories/GHSA-5jjj-9xc3-rm56

Plugin Details

Severity: High

ID: 473811

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/8/2026

Updated: 10/8/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.41

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-106440

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/7/2026

Vulnerability Publication Date: 10/6/2026

Reference Information

CVE: CVE-2026-106440

cwe: CWE-470