hydra-ecosystem Hydra up to 1.3.5 Logging Configuration logging.config.dictConfig code injection

Summaryinfo

A vulnerability marked as problematic has been reported in hydra-ecosystem Hydra up to 1.3.5. This vulnerability affects the function logging.config.dictConfig of the component Logging Configuration. This manipulation causes code injection. The identification of this vulnerability is CVE-2026-106441. The attack can only be executed locally. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in hydra-ecosystem Hydra up to 1.3.5. It has been declared as problematic. Affected by this vulnerability is the function logging.config.dictConfig of the component Logging Configuration. The manipulation with an unknown input leads to a code injection vulnerability. The CWE definition for the vulnerability is CWE-94. The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.6 and 1.4.0.dev9, Hydra passes Python logging configuration to logging.config.dictConfig() without applying Hydra's target policy to handler class values or formatter, filter, handler, queue, and listener factories. An attacker who controls Hydra logging configuration can therefore select an importable class or factory and cause it to be invoked with the application's privileges, even in versions where instantiate() is protected because the logging path does not use instantiate(). This issue is fixed in versions 1.3.6 and 1.4.0.dev9.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-106441 since 10/06/2026. The exploitation appears to be easy. Attacking locally is a requirement. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1059 according to MITRE ATT&CK.

Upgrading to version 1.3.6 or 1.4.0.dev9 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• hydra-ecosystem

Name

• Hydra

Version

• 1.3.0
• 1.3.1
• 1.3.2
• 1.3.3
• 1.3.4
• 1.3.5

Website

• Product: https://github.com/hydra-ecosystem/hydra/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion