CVE-2026-68508

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-68508
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68508.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-68508
Aliases
Downstream
Published
2026-08-21T20:09:26Z
Modified
2026-09-11T03:48:38Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Hydra: hydra.utils.instantiate with untrusted config can lead to code execution
Details

Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.4, hydra.utils.instantiate() resolves and calls Python objects selected by configuration through _resolve_target() in hydra/_internal/instantiate/_instantiate2.py, allowing attacker-controlled target values and arguments to choose dangerous callables. A consuming application, library, CLI workflow, or model loader that passes untrusted configuration, CLI overrides, or model metadata into hydra.utils.instantiate() can therefore execute arbitrary code in its own process, including reading or modifying files and credentials or terminating the process. Version 1.3.4 adds target blocking with an explicit HYDRA_INSTANTIATE_ALLOWLIST_OVERRIDE escape hatch. This issue is fixed in version 1.3.4.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-470",
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68508.json"
}
References

Affected packages

Git / github.com/hydra-ecosystem/hydra

Affected ranges

Type
GIT
Repo
https://github.com/hydra-ecosystem/hydra
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7faad0dcedfb4c0a364aa1067c0080fd6fdf8dca
Fixed
81070c4266f2c7e0bb614f84585b3bd0cb721ce1
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.3.4"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.0.0
v1.0.0rc1
v1.0.0rc2
v1.0.0rc3
v1.0.0rc4
v1.0.1
v1.0.2
v1.0.3
v1.1.0
v1.1.0.dev6
v1.1.0.rc1
v1.1.1
v1.3.0
v1.3.1
v1.3.2
v1.3.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68508.json"