Vulnerability Description
Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.4, hydra.utils.instantiate() resolves and calls Python objects selected by configuration through _resolve_target() in hydra/_internal/instantiate/_instantiate2.py, allowing attacker-controlled target values and arguments to choose dangerous callables. A consuming application, library, CLI workflow, or model loader that passes untrusted configuration, CLI overrides, or model metadata into hydra.utils.instantiate() can therefore execute arbitrary code in its own process, including reading or modifying files and credentials or terminating the process. Version 1.3.4 adds target blocking with an explicit HYDRA_INSTANTIATE_ALLOWLIST_OVERRIDE escape hatch. This issue is fixed in version 1.3.4.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/hydra-ecosystem/hydra/commit/7faad0dcedfb4c0a364aa1067c0080fd
- https://github.com/hydra-ecosystem/hydra/issues/3259
- https://github.com/hydra-ecosystem/hydra/pull/3261
- https://github.com/hydra-ecosystem/hydra/releases/tag/v1.3.4
- https://github.com/hydra-ecosystem/hydra/security/advisories/GHSA-2cp2-2r3c-7p7r
FAQ
What is CVE-2026-68508?
CVE-2026-68508 is a vulnerability with a CVSS score of 7.8 (HIGH). Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.4, hydra.utils.instantiate() resolves and calls Python objects selected by configuration through _resolve_target() in ...
How severe is CVE-2026-68508?
CVE-2026-68508 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-68508?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.