# CVE-2026-10804: Streamlit weak hash in caching component

Source: https://junglewise.ai/threats/cve-2026-10804-streamlit-weak-hash-in-caching-component  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-04. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-10804 · Severity: low · CVSS 3.6 · Published 2026-06-04

Streamlit is a popular Python library used to build and share data applications. A vulnerability in its caching mechanism could allow a local attacker to cause hash collisions, potentially leading to incorrect data being served from the cache or a minor service disruption. This occurs when the application processes specific types of image data or very large datasets, where the system fails to uniquely identify different inputs.

Technologies: [streamlit (PyPI)](https://junglewise.ai/threats/technologies/pypi-streamlit). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-10804 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10804 being exploited in the wild.

**How severe is CVE-2026-10804?** Low severity, with a CVSS score of 3.6, published 4 June 2026.

**Which products and versions are affected?** streamlit (PyPI) ECOSYSTEM:introduced=0,fixed=1.53.1; Streamlit < 1.53.1, up to 1.53.0.

**Is there a fix for CVE-2026-10804?** Yes. streamlit (PyPI): upgrade to 1.53.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-10804 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-10804?** Check whether you run streamlit (PyPI) or Streamlit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- streamlit (PyPI): upgrade to 1.53.1 or later

  ```sh
  pip install "streamlit>=1.53.1"
  ```


## Technical details

A vulnerability exists in Streamlit's hashing logic within lib/streamlit/runtime/caching/hashing.py. The implementation used a hardcoded random seed (0) when sampling large pandas, polars, and numpy objects for cache key generation, making the sampled rows predictable and prone to collisions. Additionally, the hasher omitted palette bytes for PIL P-mode images, causing images with identical pixel indices but different color palettes to produce the same hash. An attacker with local access could exploit these collisions to manipulate cache integrity or cause minor availability issues. The issue is fixed in version 1.53.1 by implementing data-dependent seeds and including palette bytes in the hash.

## Affected products

- Streamlit Streamlit < 1.53.1

## Identifiers

- CVE-2026-10804
- GHSA-vqwp-45wm-r9r5
- PYSEC-2026-212

## Timeline

- 2026-04-04: disclosed: Issue and fix PR opened on GitHub
- 2026-06-04: advisory: Published to GitHub Advisory Database and NVD
- 2026-07-15: patched: Advisory updated to reflect patched status in 1.53.1

## References

- [https://github.com/streamlit/streamlit/issues/14622](https://github.com/streamlit/streamlit/issues/14622)
- [https://github.com/streamlit/streamlit/pull/14635](https://github.com/streamlit/streamlit/pull/14635)
- [https://github.com/streamlit/streamlit](https://github.com/streamlit/streamlit)
- [https://vuldb.com/cve/CVE-2026-10804](https://vuldb.com/cve/CVE-2026-10804)
- [https://vuldb.com/submit/831508](https://vuldb.com/submit/831508)

## Related threats

- [Unauthenticated SSRF Vulnerability in Streamlit on Windows (NTLM Credential Exposure)](https://junglewise.ai/threats/cve-2026-33682-unauthenticated-ssrf-vulnerability-in-streamlit-on-windows-ntlm)
- [Path traveral in Streamlit on windows](https://junglewise.ai/threats/cve-2024-42474-path-traveral-in-streamlit-on-windows)
- [Streamlit path traversal in custom components static file handler](https://junglewise.ai/threats/streamlit-path-traversal-in-custom-components-static-file-handler-e6d7fa2a)
- [Streamlit publishes previously-patched Cross-site Scripting vulnerability](https://junglewise.ai/threats/cve-2023-27494-streamlit-publishes-previously-patched-cross-site-scripting)
- [Streamlit directory traversal vulnerability](https://junglewise.ai/threats/cve-2022-35918-streamlit-directory-traversal-vulnerability)