CVE-2026-68508
Hydra: hydra.utils.instantiate with untrusted config can lead to code execution
Reported by github_m · Published August 21, 2026
hydra-core is fixed in 1.3.4 (PyPI)
Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.4, hydra.utils.instantiate() resolves and calls Python objects selected by configuration through _resolve_target() in hydra/_internal/instantiate/_instantiate2.py, allowing attacker-controlled target values and arguments to choose dangerous callables. A consuming application, library, CLI workflow, or model loader that passes untrusted configuration, CLI overrides, or model metadata into hydra.utils.instantiate() can therefore execute arbitrary code in its own process, including reading or modifying files and credentials or terminating the process. Version 1.3.4 adds target blocking with an explicit HYDRA_INSTANTIATE_ALLOWLIST_OVERRIDE escape hatch. This issue is fixed in version 1.3.4.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| hydra-core | PyPI | 1.3.4 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| facebookresearch | hydra | < 1.3.4 |
| PyPI | hydra-core | 0 |
| facebookresearch | hydra | 0 |
| chainguard | nemo | 0 |
Timeline
- Aug 21, 2026 CVE Published
- Aug 21, 2026 CVE Updated
- Aug 22, 2026 Coalition ESS Score
- Aug 23, 2026 EPSS Score (22 in total, the first dated here)
- Sep 3, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-68508
vulnetix vdb fixes CVE-2026-68508Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-68508/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/hydra-ecosystem/hydra/security/advisories/GHSA-2cp2-2r3c-7p7r x_refsource_CONFIRM
- https://github.com/hydra-ecosystem/hydra/issues/3259 x_refsource_MISC
- https://github.com/hydra-ecosystem/hydra/pull/3261 x_refsource_MISC
- https://github.com/hydra-ecosystem/hydra/commit/7faad0dcedfb4c0a364aa1067c0080fd6fdf8dca x_refsource_MISC
- https://github.com/hydra-ecosystem/hydra/releases/tag/v1.3.4 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-68508 advisory
- https://github.com/advisories/GHSA-2cp2-2r3c-7p7r advisory