CVE-2026-15605
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
A security vulnerability has been detected in wandb version 0.25.2.dev1 in the ArtifactManifestEntry.download function within hashutil.py. It involves the use of a weak hash function during artifact integrity validation. The attack can be initiated remotely but requires a high degree of complexity.
Risk Assessment
The organization is at risk of data integrity compromise in stored artifacts, potentially allowing undetected data substitution or manipulation. The attack is difficult to execute but could have serious consequences for system trust if successful.
Recommendation
It is recommended to immediately apply the patch once available and monitor the wandb repository for the fix. Until the patch is released, restrict access to artifact-related functions and implement additional integrity verification mechanisms.
Original NVD description (English source)
A security vulnerability has been detected in wandb 0.25.2.dev1. Affected is the function ArtifactManifestEntry.download in the library wandb/sdk/lib/hashutil.py of the component Artifact Integrity Validation. The manipulation leads to use of weak hash. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The pull request to fix this issue awaits acceptance.