Hydra: Blocklist bypass via mutable instantiate policy state
Summary
Hydra is a Python framework for configuring complex applications. Versions 1.3.4 up to 1.3.7 and 1.4.0.dev4 up to 1.4.0.dev10 keep the instantiate() target blocklist in mutable process-global state. An attacker who can supply several sibling target entries in a configuration can remove a denied target from the policy and then invoke it, which can lead to code execution with the application's privileges. The attack requires that untrusted configuration reaches instantiate() and that a user interacts with the process (CVSS UI:P).
Affected
- Hydra >= 1.3.4 and < 1.3.7
- Hydra >= 1.4.0.dev4 and < 1.4.0.dev10
Fixed in
- Hydra 1.3.7
- Hydra 1.4.0.dev10
- Note: a separate, unverified third-party report mentions a newer advisory that may require Hydra 1.3.8. Check the vendor advisory before relying on it.
Workaround
- Do not pass configuration from untrusted sources to instantiate() or to Hydra-controlled Python logging configuration.
- Validate untrusted configurations against a schema and reject unexpected _target_ values.
- Do not treat the Hydra blocklist as a security boundary.
Exploitation
- CISA SSVC lists exploitation as 'poc' (proof of concept available); automatable: no; technical impact: total.
- Not listed in CISA KEV; no confirmed exploitation in the wild is known.
Our recommendation
- Inventory all hydra-core installations, including transitive dependencies, in Python environments.
- Upgrade to at least Hydra 1.3.7 or 1.4.0.dev10 and check the vendor advisory for newer fixed versions.
- Until patched, block untrusted configuration from reaching Hydra instantiate() and logging configuration.
- Monitor ML and data pipelines for unexpected processes started from configuration files.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-106439 (OSV) osv.dev
- GHSA-mwj6-rfh8-7qf4 (Hydra security advisory) github.com
- GHSA-mwj6-rfh8-7qf4 (OSV) osv.dev
- Hydra release v1.3.7 github.com
- Fix commit 0dd1808 github.com
- Fix commit 4720dfc github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:20.
Original description (NVD)
Hydra is a framework for elegantly configuring complex applications. From 1.3.4 until 1.3.7 and 1.4.0.dev10, Hydra stores legacy instantiate target blocklists and related execution-policy collections in mutable module-level state. An attacker who controls multiple sibling target entries can resolve hydra._internal.target_policy.UNCONTROLLED_EXECUTION_TARGETS.discard through instantiate(), remove a denied target, and then invoke that target because sibling nodes are processed in insertion order against the same modified policy. The mutation persists in process-global state and can enable code execution with the application's privileges, while a narrow execution whitelist supplied by trusted Python code is not bypassed by the reported direct mutation path. This issue is fixed in versions 1.3.7 and 1.4.0.dev10.
NVD references (5)
- https://github.com/hydra-ecosystem/hydra/commit/0dd18084589a3d3e577d1f1a8a48fb485c94a5e6
- https://github.com/hydra-ecosystem/hydra/commit/4720dfca2bde27fa140ec287a05709668fbdf168
- https://github.com/hydra-ecosystem/hydra/releases/tag/v1.3.7
- https://github.com/hydra-ecosystem/hydra/security/advisories/GHSA-mwj6-rfh8-7qf4
- https://github.com/hydra-ecosystem/hydra/security/advisories/GHSA-mwj6-rfh8-7qf4
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.