{"id":"CVE-2026-106441","published":"2026-10-06T19:18:13.020","lastModified":"2026-10-07T19:17:32.150","description":"Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.6 and 1.4.0.dev9, Hydra passes Python logging configuration to logging.config.dictConfig() without applying Hydra's target policy to handler class values or formatter, filter, handler, queue, and listener factories. An attacker who controls Hydra logging configuration can therefore select an importable class or factory and cause it to be invoked with the application's privileges, even in versions where instantiate() is protected because the logging path does not use instantiate(). This issue is fixed in versions 1.3.6 and 1.4.0.dev9.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://github.com/hydra-ecosystem/hydra/commit/76bfc30ce1f3105416941dd2e3a562568e369120","tags":[]},{"url":"https://github.com/hydra-ecosystem/hydra/commit/ff3e4dba890c29a21d8c2bb867ee87d37ccf21d0","tags":[]},{"url":"https://github.com/hydra-ecosystem/hydra/pull/3420","tags":[]},{"url":"https://github.com/hydra-ecosystem/hydra/security/advisories/GHSA-c3wx-c55w-pxjq","tags":[]}],"exploitRefs":[{"url":"https://github.com/hydra-ecosystem/hydra/commit/76bfc30ce1f3105416941dd2e3a562568e369120","tags":[]},{"url":"https://github.com/hydra-ecosystem/hydra/commit/ff3e4dba890c29a21d8c2bb867ee87d37ccf21d0","tags":[]},{"url":"https://github.com/hydra-ecosystem/hydra/pull/3420","tags":[]},{"url":"https://github.com/hydra-ecosystem/hydra/security/advisories/GHSA-c3wx-c55w-pxjq","tags":[]}],"hasPoc":true,"ai":{"summary":"Hydra framework allows attackers to inject arbitrary Python classes into logging configuration, potentially leading to remote code execution through logging handlers and formatters. This vulnerability affects versions prior to 1.3.6 and 1.4.0.dev9 where logging configuration bypasses Hydra's security policies.","exploitability":"Moderately difficult to exploit as it requires an attacker to control Hydra's logging configuration, but can be achieved through configuration files or API endpoints that accept logging settings.","blast_radius":"High impact in environments where Hydra is used for application configuration and attackers can influence logging configurations, potentially leading to full system compromise.","remediation":"Upgrade to version 1.3.6 or 1.4.0.dev9 to fix the logging configuration vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","config","python"],"model":"garnet-coder","analyzedAt":"2026-10-14T09:01:20.530Z"}}