CVE-2026-106441

Name of the Vulnerable Software and Affected Versions Hydra versions prior to 1.3.6 Hydra versions prior to 1.4.0.dev9

Description Hydra passes Python logging configuration to logging.config.dictConfig() without applying the target policy to handler class values or formatter, filter, handler, queue, and listener factories. An attacker who controls the logging configuration can select an importable class or factory and cause it to be invoked with the application's privileges. This occurs because the logging path bypasses the instantiate() function, which is used for protection in other areas of the framework.

Recommendations Update to version 1.3.6 or later. Update to version 1.4.0.dev9 or later.