Is CVE-2026-106441 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-106441 being exploited in the wild.

How severe is CVE-2026-106441?

High severity, with a CVSS score of 7.8, published 6 October 2026.

Which products and versions are affected?

Hydra before 1.3.6 and before 1.4.0.dev9; hydra-core (PyPI) ECOSYSTEM:introduced=0,fixed=1.3.6, ECOSYSTEM:introduced=0,fixed=1.3.6,introduced=1.4.0.dev0,fixed=1.4.0.dev9.

Is there a fix for CVE-2026-106441?

Yes. hydra-core (PyPI): upgrade to 1.3.6, 1.4.0.dev9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-106441 attacked?

It is attacked over the network.

Am I affected by CVE-2026-106441?

Check whether you run Hydra or hydra-core (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106441: Hydra logging configuration arbitrary code execution

CVE-2026-106441 · Severity: high · CVSS 7.8 · Published 2026-10-06

Hydra is a framework for configuring complex applications. When Hydra processes logging configuration, it fails to apply security restrictions to handler and formatter classes, allowing an attacker who controls the logging config to invoke arbitrary code with the application's privileges, even if other protections are in place.

Technologies: hydra-core (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-106441 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-106441 being exploited in the wild.
How severe is CVE-2026-106441?: High severity, with a CVSS score of 7.8, published 6 October 2026.
Which products and versions are affected?: Hydra before 1.3.6 and before 1.4.0.dev9; hydra-core (PyPI) ECOSYSTEM:introduced=0,fixed=1.3.6, ECOSYSTEM:introduced=0,fixed=1.3.6,introduced=1.4.0.dev0,fixed=1.4.0.dev9.
Is there a fix for CVE-2026-106441?: Yes. hydra-core (PyPI): upgrade to 1.3.6, 1.4.0.dev9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106441 attacked?: It is attacked over the network.
Am I affected by CVE-2026-106441?: Check whether you run Hydra or hydra-core (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

hydra-core (PyPI): upgrade to 1.3.6, 1.4.0.dev9 or later
```
pip install "hydra-core>=1.4.0.dev9"
```

Technical details

The vulnerability exists in how Hydra passes Python logging configuration to logging.config.dictConfig() without applying target authorization policy to handler class values, formatters, filters, handlers, queues, and listener factories. An attacker controlling the logging configuration can select any importable class or factory and cause it to be instantiated with application privileges, bypassing Hydra's instantiate() protections because the logging path does not use instantiate(). The fix applies target authorization to logging configuration to restrict which classes and factories can be instantiated.

Affected products

Hydra Hydra before 1.3.6 and before 1.4.0.dev9

Identifiers

CVE-2026-106441
GHSA-c3wx-c55w-pxjq
PYSEC-2026-4221

Timeline

2026-10-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.