CVE-2026-10766

LowCVSS 3.6

Published: 03/06/2026(UTC)Updated: 22/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.08%

0th percentile - higher than 0% of all known CVEs

Summary

In mlrun up to version 1.12.0-rc3, the function mlrun.utils.helpers.calculate_dataframe_hash in file mlrun/utils/helpers.py (DataFrame Hash Handler component) uses a weak hash. The attack requires local access and is difficult. The exploit has been publicly disclosed.

Risk Assessment

Weak hash may allow an attacker to manipulate the dataframe hash, potentially leading to data integrity issues.

Recommendation

Apply the pending pull request fix or upgrade to a newer version as soon as available.

Original NVD description (English source)

A vulnerability has been found in mlrun up to 1.12.0-rc3. This impacts the function mlrun.utils.helpers.calculate_dataframe_hash of the file mlrun/utils/helpers.py of the component DataFrame Hash Handler. The manipulation leads to use of weak hash. The attack can only be performed from a local environment. The complexity of an attack is rather high. The exploitability is said to be difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.