# hydra-core (PyPI) vulnerabilities

5 known vulnerabilities (5 high), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 1.3.8 (Oct 25, 2026): no advisory affects it
- Newest unaffected release: 1.3.8 (Oct 25, 2026), the latest release
- Weekly downloads: 4.2M
- Dependents: 0
- Releases: 64 since 0.1.4 (Sep 19, 2019)
- Registry: https://pypi.org/project/hydra-core/
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- GHSA-WF6J-7HVR-GR93: 1.3.6 to 1.3.7 (1.3.8 is outside it); 1.4.0.dev9 to 1.4.0rc2 (1.4.0rc3 is outside it)
- CVE-2026-106442: 1.3.4 to 1.3.5 (1.3.6 is outside it); 1.4.0.dev1 to 1.4.0.dev8 (1.4.0.dev9 is outside it)
- CVE-2026-106441: 0.1.4 to 1.3.5 (1.3.6 is outside it); 1.4.0.dev1 to 1.4.0.dev8 (1.4.0.dev9 is outside it)
- CVE-2026-106439: 1.3.4 to 1.3.6 (1.3.7 is outside it); 1.4.0.dev4 to 1.4.0.dev9 (1.4.0.dev10 is outside it)
- CVE-2026-68508: 0.1.4 to 1.3.3 (1.3.4 is outside it)

## Advisories (5)

### [GHSA-WF6J-7HVR-GR93](https://cve.now/GHSA-WF6J-7HVR-GR93): Hydra legacy target blacklist permits unsafe PyYAML loading

- Severity: High
- Published: Oct 27, 2026
- Affected: from 1.3.6, fixed in 1.3.8; from 1.4.0.dev9, fixed in 1.4.0rc3.
- Fixed in 1.3.8 (released Oct 25, 2026, 2 days before disclosure) and 1.4.0rc3 (released Oct 25, 2026, 2 days before disclosure).
- The latest release, 1.3.8, is not affected.

### [CVE-2026-106442](https://cve.now/CVE-2026-106442): Hydra instantiate target blacklist bypasses permit code execution

- Severity: High 7.8
- Published: Oct 6, 2026
- Affected: from 1.3.4, fixed in 1.3.6; from 1.4.0.dev0, fixed in 1.4.0.dev9; from 1.3.4, fixed in 1.3.6; from 1.4.0.dev0, fixed in 1.4.0.dev9.
- Fixed in 1.3.6 (released Aug 29, 2026, 38 days before disclosure) and 1.4.0.dev9 (released Aug 30, 2026, 37 days before disclosure).
- The latest release, 1.3.8, is not affected.

### [CVE-2026-106441](https://cve.now/CVE-2026-106441): Hydra logging configuration permits unsafe callable resolution

- Severity: High 7.8
- Published: Oct 6, 2026
- Affected: fixed in 1.3.6; from 1.4.0.dev0, fixed in 1.4.0.dev9; fixed in 1.3.6; from 1.4.0.dev0, fixed in 1.4.0.dev9.
- Fixed in 1.3.6 (released Aug 29, 2026, 38 days before disclosure) and 1.4.0.dev9 (released Aug 30, 2026, 37 days before disclosure).
- The latest release, 1.3.8, is not affected.

### [CVE-2026-106439](https://cve.now/CVE-2026-106439): Hydra: Mutable instantiate policy sets allow target blocklist bypass

- Severity: High 8.5
- Published: Oct 6, 2026
- Affected: from 1.3.4, fixed in 1.3.7; from 1.4.0.dev4, fixed in 1.4.0.dev10; from 1.3.4, fixed in 1.3.7; from 1.4.0.dev4, fixed in 1.4.0.dev10.
- Fixed in 1.3.7 (released Sep 14, 2026, 22 days before disclosure) and 1.4.0.dev10 (released Sep 14, 2026, 22 days before disclosure).
- The latest release, 1.3.8, is not affected.

### [CVE-2026-68508](https://cve.now/CVE-2026-68508): Hydra: hydra.utils.instantiate with untrusted config can lead to code execution

- Severity: High 7.8
- Published: Aug 21, 2026
- Affected: fixed in 1.3.4.
- Fixed in 1.3.4 (released Jul 4, 2026, 48 days before disclosure).
- The latest release, 1.3.8, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/pypi/hydra-core
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.