CVE-2026-106439

Hydra from 1.3.4 until 1.3.6 and 1.4.0.dev9 has an incomplete target blacklist for instantiate() that does not fully check the effective callable selected by the target field. Execution wrappers such as timeit.timeit, pickle.loads, aliases, callable-returning helpers, generic dispatch, and deferred calls can obscure or defer the effective target and bypass name-based authorization.

Hydra prior to 1.3.6 and 1.4.0.dev9 passes Python logging configuration to logging.config.dictConfig() without applying Hydra's target policy to handler class values or formatter, filter, handler, queue, and listener factories. An attacker who controls Hydra logging configuration can select an importable class or factory and cause it to be invoked with the application's privileges.

Hydra from 1.2.0 until 1.3.0 and 1.4.0.dev10 in the hydra-optuna-sweeper package accepts a configuration-controlled dotted path in hydra.sweeper.custom_search_space, resolves it with hydra.utils.get_method(), and later invokes the returned callable in the Hydra controller process. Because get_method() does not apply the execution policy used by instantiate(), an attacker who controls Optuna sweep configuration or command-line overrides can select importable Python code for execution with the application's privileges.

Hydra before version 1.3.4 has an arbitrary code execution vulnerability. The hydra.utils.instantiate() function resolves and calls Python objects selected by configuration, allowing an attacker to invoke dangerous callables.

A stack buffer overflow vulnerability in Hydra through version 9.7 (fixed in commit 9cc84c2) affects NTLM authentication in SMTP, POP3, IMAP, NNTP, HTTP, HTTP-Proxy, and HTTP-Proxy-Urlenum modules when processing malicious NTLM Type-2 challenges. A remote server can send a crafted challenge with an excessively long domain string, causing base64-encoded response data to overflow a 500-byte stack buffer by 18 to 330 bytes, enabling remote code execution on systems without stack protection.