CVE-2026-68508: Hydra hydra.utils.instantiate code injection with untrusted config

CVE-2026-68508 · Severity: high · CVSS 7.8 · Published 2026-08-21

Hydra is a configuration framework used in Python applications to construct objects and call functions from configuration files. When an application passes untrusted configuration to the instantiate() function, an attacker can specify arbitrary Python callables in the _target_ field and cause code execution with the privileges of the process running the application. This commonly affects AI/ML applications that load model metadata from untrusted sources.

Technologies: hydra-core (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-68508 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-68508 being exploited in the wild.
How severe is CVE-2026-68508?
High severity, with a CVSS score of 7.8, published 21 August 2026.
Which products and versions are affected?
hydra-core (PyPI) <= 1.3.3, ECOSYSTEM:introduced=0,fixed=1.3.4.
Is there a fix for CVE-2026-68508?
Yes. hydra-core (PyPI): upgrade to 1.3.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-68508 attacked?
It is attacked with local access.
Am I affected by CVE-2026-68508?
Check whether you run hydra-core (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • hydra-core (PyPI): upgrade to 1.3.4 or later
    pip install "hydra-core>=1.3.4"

Technical details

Hydra's instantiate API is designed to resolve and call Python objects specified in configuration using a _target_ field. The vulnerability is a code injection issue (CWE-94) combined with unsafe reflection (CWE-470): if untrusted input controls the _target_ value, an attacker can select any callable in the Python environment and provide attacker-controlled arguments. Exploitation requires a consuming application to load and pass untrusted config, CLI overrides, or model metadata directly to instantiate() without validation. Version 1.3.4 adds a blacklist of dangerous targets as defense-in-depth, but the primary mitigation is for applications to validate _target_ values against a trusted allowlist before instantiation. The unreleased version 1.4 will use an allowlist-based model by default.

Affected products

  • hydra-ecosystem hydra-core <= 1.3.3

Identifiers

  • CVE-2026-68508
  • GHSA-2cp2-2r3c-7p7r
  • PYSEC-2026-3850

Timeline

  • 2026-07-24: disclosed: Published by GitHub
  • 2026-08-21: advisory: Added to GitHub Advisory Database
  • 2026-08-21: patched: Version 1.3.4 released with blacklist mitigation

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.