CVE-2026-106442

Hydra is a framework for elegantly configuring complex applications. From 1.3.4 until 1.3.6 and 1.4.0.dev9, the instantiate() target blacklist introduced for CVE-2026-68508 incompletely checks the effective callable selected by the target field. Execution wrappers such as timeit.timeit, executable deserialization through pickle.loads, aliases, callable-returning helpers, generic dispatch, and deferred calls can obscure or defer the effective target and bypass name-based authorization. An attacker who causes an application to instantiate untrusted Hydra configuration can use these gaps to execute code with the application's privileges. This issue is fixed in versions 1.3.6 and 1.4.0.dev9.

• CWE-184

• https://github.com/hydra-ecosystem/hydra/commit/2c82bbb3f39603b336cb852461739fdf7a38798a
• https://github.com/hydra-ecosystem/hydra/commit/f462811117b5ecfd2ed652ed52d6b4e3771bd943
• https://github.com/hydra-ecosystem/hydra/pull/3412
• https://github.com/hydra-ecosystem/hydra/pull/3413
• https://github.com/hydra-ecosystem/hydra/releases/tag/v1.3.6
• https://github.com/hydra-ecosystem/hydra/security/advisories/GHSA-rqx7-p7vv-w7hr

Published

Oct 6, 2026

Last Modified

Oct 7, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-106427Confused deputy in Mobile in Google Chrome on on iOS prior t…5.4
• CVE-2026-10643Zephyr's IP socket recvmsg() implementation (subsys/net/lib/…7.8
• CVE-2026-106439Hydra is a framework for elegantly configuring complex appli…8.5
• CVE-2026-10644The Microchip SERCOM-G1 UART driver (drivers/serial/uart_mch…3.1
• CVE-2026-106440Hydra is a framework for elegantly configuring complex appli…7.8
• CVE-2026-106441Hydra is a framework for elegantly configuring complex appli…7.8
• CVE-2026-106443WeasyPrint helps web developers to create PDF documents. Pri…8.8
• CVE-2026-106444Handlebars provides the power necessary to let users build s…4.7
• CVE-2026-106445Handlebars provides the power necessary to let users build s…9.2
• CVE-2026-106446Handlebars provides the power necessary to let users build s…9.8
• CVE-2026-106447StableLib is a stable library of useful TypeScript and JavaS…8.7
• CVE-2026-106448StableLib is a stable library of useful TypeScript and JavaS…8.9