CVE-2026-10766

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-10766
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10766.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-10766
Aliases
Published
2026-06-03T20:00:11.168Z
Modified
2026-07-15T01:49:20.958280552Z
Severity
  • 1.1 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
mlrun DataFrame Hash helpers.py mlrun.utils.helpers.calculate_dataframe_hash weak hash
Details

A vulnerability has been found in mlrun up to 1.12.0-rc3. This impacts the function mlrun.utils.helpers.calculatedataframehash of the file mlrun/utils/helpers.py of the component DataFrame Hash Handler. The manipulation leads to use of weak hash. The attack can only be performed from a local environment. The complexity of an attack is rather high. The exploitability is said to be difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.

Database specific 
{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-327",
        "CWE-328"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10766.json"
}
References

Affected packages

Git / github.com/mlrun/mlrun

Affected ranges

Type
GIT
Repo
https://github.com/mlrun/mlrun
Events
Introduced
aacc4261c0d8a47a90ea46f9d58c44bc3c068beb
Last affected
c0e21278faf0bbccc9506d7c9213dba5cb7cefe6
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "1.12.0-rc1"
        },
        {
            "last_affected": "1.12.0-rc1"
        },
        {
            "introduced": "1.12.0-rc2"
        },
        {
            "last_affected": "1.12.0-rc2"
        },
        {
            "introduced": "1.12.0-rc3"
        },
        {
            "last_affected": "1.12.0-rc3"
        }
    ]
}

Affected versions

1.*
1.12.0-rc1
1.12.0-rc2
1.12.0-rc3
v1.*
v1.12.0-rc1
v1.12.0-rc2
v1.12.0-rc3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10766.json"