CVE-2026-56766

In Hydra (a layer-two scalability solution for Cardano) before 2.1.0, the Claim branch in the deposit validator only checks that datum.head_id matches the attacker-controlled redeemer.currencySymbol and that the transaction is valid before the deposit deadline. It neither requires spending the Head state-token UTxO in the same transaction nor constrains outputs, so after a deposit via POST /commit is confirmed, any third party can consume the pending deposit UTxO and redirect the assets to an arbitrary address.

Hydra from 1.3.4 until 1.3.6 and 1.4.0.dev9 has an incomplete target blacklist for instantiate() that does not fully check the effective callable selected by the target field. Execution wrappers such as timeit.timeit, pickle.loads, aliases, callable-returning helpers, generic dispatch, and deferred calls can obscure or defer the effective target and bypass name-based authorization.

Hydra prior to 1.3.6 and 1.4.0.dev9 passes Python logging configuration to logging.config.dictConfig() without applying Hydra's target policy to handler class values or formatter, filter, handler, queue, and listener factories. An attacker who controls Hydra logging configuration can select an importable class or factory and cause it to be invoked with the application's privileges.

Hydra from 1.2.0 until 1.3.0 and 1.4.0.dev10 in the hydra-optuna-sweeper package accepts a configuration-controlled dotted path in hydra.sweeper.custom_search_space, resolves it with hydra.utils.get_method(), and later invokes the returned callable in the Hydra controller process. Because get_method() does not apply the execution policy used by instantiate(), an attacker who controls Optuna sweep configuration or command-line overrides can select importable Python code for execution with the application's privileges.

Hydra from 1.3.4 until 1.3.7 and 1.4.0.dev10 stores legacy instantiate target blocklists and related execution-policy collections in mutable module-level state. An attacker who controls multiple sibling target entries can resolve hydra._internal.target_policy.UNCONTROLLED_EXECUTION_TARGETS.discard through instantiate(), remove a denied target, and then invoke that target because sibling nodes are processed in insertion order against the same modified policy.

Hydra before version 1.3.4 has an arbitrary code execution vulnerability. The hydra.utils.instantiate() function resolves and calls Python objects selected by configuration, allowing an attacker to invoke dangerous callables.