CVE-2026-10804 in Streamlit
Summary
by MITRE • 06/04/2026
A vulnerability has been found in Streamlit up to 1.53.0. Impacted is an unknown function in the library lib/streamlit/runtime/caching/hashing.py of the component Palette Handler. Such manipulation leads to use of weak hash. Local access is required to approach this attack. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 06/04/2026
This vulnerability resides within streamlit's caching mechanism specifically in the hashing.py file located in lib/streamlit/runtime/caching/hashing.py. The flaw manifests in an unknown function within the Palette Handler component that employs weak hashing algorithms instead of robust cryptographic functions. The vulnerability represents a significant security concern as it undermines the integrity of streamlit's caching system which is designed to optimize performance by storing computed results. The use of weak hash functions creates potential attack vectors where adversaries could manipulate cached data or potentially bypass security controls that rely on proper cryptographic hashing. This issue affects streamlit versions up to 1.53.0, indicating that the vulnerability has existed for some time within the codebase. The attack requires local access to the system, meaning an attacker must already have compromised access to the target machine or environment where streamlit is running. This local requirement significantly reduces the attack surface but does not eliminate the risk entirely, particularly in environments where privilege escalation or lateral movement is possible. The complexity level of exploitation is classified as high, suggesting that sophisticated techniques are required to successfully leverage this vulnerability. This high complexity requirement typically involves understanding the specific internal workings of streamlit's caching system and the precise conditions under which the weak hashing occurs. The vulnerability has been publicly disclosed, meaning that threat actors who are aware of the issue can potentially develop exploits against systems running affected versions. The fact that a pull request exists to address this issue indicates that the maintainers are aware of the problem and have identified a fix, though the patch has not yet been accepted or merged into the main codebase. This delay in patch acceptance could leave users exposed to potential exploitation for an extended period. The weakness in the hashing implementation could have broader implications for applications built on streamlit, as compromised caching mechanisms may allow attackers to manipulate application state, inject malicious data, or potentially cause denial of service conditions. This vulnerability aligns with CWE-327 which addresses the use of weak cryptographic algorithms and CWE-328 which covers the use of weak hash functions. From an operational perspective, this vulnerability impacts the security posture of streamlit applications by potentially allowing attackers to compromise the integrity of cached data. Applications that rely heavily on caching for performance optimization may be particularly vulnerable since the weakness directly targets the core caching infrastructure. The impact extends beyond simple data manipulation to potentially affect application availability and data integrity, especially in scenarios where cached results are used for security decisions or access control mechanisms. Organizations using streamlit should prioritize upgrading to versions that contain the fix, while those unable to upgrade immediately should consider implementing additional monitoring and access controls to mitigate potential exploitation attempts. The vulnerability also highlights the importance of proper cryptographic implementation in application frameworks and the need for thorough security reviews of caching mechanisms that handle sensitive data or user input.