Is CVE-2026-10804 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10804 being exploited in the wild.

How severe is CVE-2026-10804?

Low severity, with a CVSS score of 3.6, published 4 June 2026.

Which products and versions are affected?

streamlit (PyPI) ECOSYSTEM:introduced=0,fixed=1.53.1; Streamlit < 1.53.1, up to 1.53.0.

Is there a fix for CVE-2026-10804?

Yes. streamlit (PyPI): upgrade to 1.53.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-10804 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-10804?

Check whether you run streamlit (PyPI) or Streamlit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10804: Streamlit weak hash in caching component

Q: Is there a fix for CVE-2026-10804?

Yes. streamlit (PyPI): upgrade to 1.53.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-10804 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-10804?

Check whether you run streamlit (PyPI) or Streamlit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10804 · Severity: low · CVSS 3.6 · Published 2026-06-04

Streamlit is a popular Python library used to build and share data applications. A vulnerability in its caching mechanism could allow a local attacker to cause hash collisions, potentially leading to incorrect data being served from the cache or a minor service disruption. This occurs when the application processes specific types of image data or very large datasets, where the system fails to uniquely identify different inputs.

Technologies: streamlit (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-10804 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10804 being exploited in the wild.
How severe is CVE-2026-10804?: Low severity, with a CVSS score of 3.6, published 4 June 2026.
Which products and versions are affected?: streamlit (PyPI) ECOSYSTEM:introduced=0,fixed=1.53.1; Streamlit < 1.53.1, up to 1.53.0.
Is there a fix for CVE-2026-10804?: Yes. streamlit (PyPI): upgrade to 1.53.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-10804 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-10804?: Check whether you run streamlit (PyPI) or Streamlit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

streamlit (PyPI): upgrade to 1.53.1 or later
```
pip install "streamlit>=1.53.1"
```

Technical details

A vulnerability exists in Streamlit's hashing logic within lib/streamlit/runtime/caching/hashing.py. The implementation used a hardcoded random seed (0) when sampling large pandas, polars, and numpy objects for cache key generation, making the sampled rows predictable and prone to collisions. Additionally, the hasher omitted palette bytes for PIL P-mode images, causing images with identical pixel indices but different color palettes to produce the same hash. An attacker with local access could exploit these collisions to manipulate cache integrity or cause minor availability issues. The issue is fixed in version 1.53.1 by implementing data-dependent seeds and including palette bytes in the hash.

Affected products

Streamlit Streamlit < 1.53.1

Identifiers

CVE-2026-10804
GHSA-vqwp-45wm-r9r5
PYSEC-2026-212

Timeline

2026-04-04: disclosed: Issue and fix PR opened on GitHub
2026-06-04: advisory: Published to GitHub Advisory Database and NVD
2026-07-15: patched: Advisory updated to reflect patched status in 1.53.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.