https://vulnerability.circl.lu/sightings/feed 2026-08-25T14:14:57.743620+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/dc53e260-5c06-44ca-acb0-f417ddb76627/export 2026-08-25T14:14:57.766845+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "dc53e260-5c06-44ca-acb0-f417ddb76627", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-68508", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtmxu3xlo22r", "content": "\ud83d\udfe0 CVE-2026-68508 - High (7.8)\n\nHydra is a framework for elegantly configuring complex applications. Prior to 1.3.4, hydra.utils....\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-68508/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-22T00:01:24.674073Z"} 2026-08-22T00:01:24.674073+00:00 https://vulnerability.circl.lu/sighting/07fd9033-cb5d-4f3e-bf4c-ce2dadceb63d/export 2026-08-25T14:14:57.769667+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "07fd9033-cb5d-4f3e-bf4c-ce2dadceb63d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-68508", "type": "seen", "source": "https://gist.github.com/alon710/fe62230d534aaa9446cebd76e965c0c0", "content": "# CVE-2026-68508: CVE-2026-68508: Arbitrary Code Execution via Unsafe Dynamic Instantiation in Hydra Core\n\n> **CVSS Score:** 7.8\n> **Published:** 2026-08-21\n> **Full Report:** https://cvereports.com/reports/CVE-2026-68508\n\n## Summary\nCVE-2026-68508 is a high-severity arbitrary code execution vulnerability in facebookresearch/hydra (hydra-core) prior to version 1.3.4. The vulnerability exists within the dynamic instantiation system hydra.utils.instantiate(), which resolves and executes arbitrary Python callables from configuration files. An attacker capable of submitting untrusted configurations can achieve arbitrary code execution in the context of the consuming process.\n\n## TL;DR\nA vulnerability in hydra-core before 1.3.4 allows unauthenticated arbitrary code execution via crafted configuration files processed by the unsafe dynamic object instantiation utility.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-94 / CWE-470\n- **Attack Vector**: Local (AV:L)\n- **CVSS Score**: 7.8 (High)\n- **Exploit Status**: PoC\n- **CISA KEV Status**: Not Listed\n- **Ransomware Use**: No Known Association\n\n## Affected Systems\n\n- facebookresearch/hydra (hydra-core)\n- **hydra-core**: < 1.3.4 (Fixed in: `1.3.4`)\n\n## Mitigation\n\n- Upgrade hydra-core to version 1.3.4 or higher to enforce target blocklisting\n- Configure HYDRA_INSTANTIATE_ALLOWLIST_OVERRIDE for required targets\n- Implement application-level safe loader wrappers to validate target paths\n- Migrate to the default-deny allowlist architecture of Hydra 1.4+\n\n**Remediation Steps:**\n1. Update requirements.txt or dependency lockfiles to require hydra-core>=1.3.4\n2. Locate applications utilizing hydra.utils.instantiate() on external files\n3. Implement verification boundaries on configuration metadata parsed from third-party hubs\n\n## References\n\n- [GitHub Security Advisory GHSA-2cp2-2r3c-7p7r](https://github.com/hydra-ecosystem/hydra/security/advisories/GHSA-2cp2-2r3c-7p7r)\n- [CVE-2026-68508 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-68508)\n- [Hydra Issue Tracker #3259](https://github.com/hydra-ecosystem/hydra/issues/3259)\n- [Hydra Pull Request #3261](https://github.com/hydra-ecosystem/hydra/pull/3261)\n- [Palo Alto Networks Unit 42 Analysis](https://unit42.paloaltonetworks.com/rce-vulnerabilities-in-ai-python-libraries/)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-68508) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-22T00:00:23.438979Z"} 2026-08-22T00:00:23.438979+00:00 https://vulnerability.circl.lu/sighting/bc9115e1-4d0c-4de7-888b-40ab32625887/export 2026-08-25T14:14:57.769894+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "bc9115e1-4d0c-4de7-888b-40ab32625887", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-68508", "type": "seen", "source": "https://gist.github.com/alon710/fe62230d534aaa9446cebd76e965c0c0", "content": "# CVE-2026-68508: CVE-2026-68508: Arbitrary Code Execution via Unsafe Dynamic Instantiation in Hydra Core\n\n> **CVSS Score:** 7.8\n> **Published:** 2026-08-21\n> **Full Report:** https://cvereports.com/reports/CVE-2026-68508\n\n## Summary\nCVE-2026-68508 is a high-severity arbitrary code execution vulnerability in facebookresearch/hydra (hydra-core) prior to version 1.3.4. The vulnerability exists within the dynamic instantiation system hydra.utils.instantiate(), which resolves and executes arbitrary Python callables from configuration files. An attacker capable of submitting untrusted configurations can achieve arbitrary code execution in the context of the consuming process.\n\n## TL;DR\nA vulnerability in hydra-core before 1.3.4 allows unauthenticated arbitrary code execution via crafted configuration files processed by the unsafe dynamic object instantiation utility.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-94 / CWE-470\n- **Attack Vector**: Local (AV:L)\n- **CVSS Score**: 7.8 (High)\n- **Exploit Status**: PoC\n- **CISA KEV Status**: Not Listed\n- **Ransomware Use**: No Known Association\n\n## Affected Systems\n\n- facebookresearch/hydra (hydra-core)\n- **hydra-core**: < 1.3.4 (Fixed in: `1.3.4`)\n\n## Mitigation\n\n- Upgrade hydra-core to version 1.3.4 or higher to enforce target blocklisting\n- Configure HYDRA_INSTANTIATE_ALLOWLIST_OVERRIDE for required targets\n- Implement application-level safe loader wrappers to validate target paths\n- Migrate to the default-deny allowlist architecture of Hydra 1.4+\n\n**Remediation Steps:**\n1. Update requirements.txt or dependency lockfiles to require hydra-core>=1.3.4\n2. Locate applications utilizing hydra.utils.instantiate() on external files\n3. Implement verification boundaries on configuration metadata parsed from third-party hubs\n\n## References\n\n- [GitHub Security Advisory GHSA-2cp2-2r3c-7p7r](https://github.com/hydra-ecosystem/hydra/security/advisories/GHSA-2cp2-2r3c-7p7r)\n- [CVE-2026-68508 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-68508)\n- [Hydra Issue Tracker #3259](https://github.com/hydra-ecosystem/hydra/issues/3259)\n- [Hydra Pull Request #3261](https://github.com/hydra-ecosystem/hydra/pull/3261)\n- [Palo Alto Networks Unit 42 Analysis](https://unit42.paloaltonetworks.com/rce-vulnerabilities-in-ai-python-libraries/)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-68508) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-21T23:32:10.351674Z"} 2026-08-21T23:32:10.351674+00:00