CVE-2026-106440

Name of the Vulnerable Software and Affected Versions hydra-optuna-sweeper versions 1.2.0 through 1.3.0 hydra-optuna-sweeper versions 1.4.0.dev1 through 1.4.0.dev9

Description The hydra-optuna-sweeper package accepts a configuration-controlled dotted path in hydra.sweeper.custom search space, which is resolved using the hydra.utils.get method() function and subsequently invoked in the Hydra controller process. Since get method() is a trusted-input lookup helper that does not apply the execution policy used by instantiate(), an attacker controlling the Optuna sweep configuration or command-line overrides can execute importable Python code with the application's privileges. This can lead to the bypass of a trusted execution whitelist on affected Hydra 1.4 development releases.

Recommendations Update to version 1.3.0. Update to version 1.4.0.dev10.