wandb 0.25.2.dev1 Artifact Integrity Validation hashutil.py ArtifactManifestEntry.download weak hash

Summaryinfo

A vulnerability, which was classified as problematic, was found in wandb 0.25.2.dev1. Affected by this vulnerability is the function ArtifactManifestEntry.download in the library wandb/sdk/lib/hashutil.py of the component Artifact Integrity Validation. The manipulation results in weak hash. This vulnerability is cataloged as CVE-2026-15605. The attack may be launched remotely. There is no exploit available. The pull request to fix this issue awaits acceptance.

Detailsinfo

A vulnerability was found in wandb 0.25.2.dev1. It has been classified as problematic. Affected is the function ArtifactManifestEntry.download in the library wandb/sdk/lib/hashutil.py of the component Artifact Integrity Validation. The manipulation with an unknown input leads to a weak hash vulnerability. CWE is classifying the issue as CWE-328. The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack). This is going to have an impact on confidentiality.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-15605. The exploitability is told to be difficult. It is possible to launch the attack remotely. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1600.001 by the MITRE ATT&CK project.

The pull request to fix this issue awaits acceptance.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-43578). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• wandb

Version

• 0.25.2.dev1

Website

• Product: https://github.com/wandb/wandb/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #855675: Weights & Biases wandb 0.25.2.dev1 at commit 28cc0bf5a9b529b72e5e501d0a48c6c42220ae0a; earlier versions may be affected if they use the same MD5-based CWE-328 Use of Weak Hash (by Dem0000000)

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion