CVE-2026-106439

The Hydra configuration framework is vulnerable in versions 1.3.4 until 1.3.7 and 1.4.0.dev10 due to the storage of legacy instantiate target blocklists in mutable module-level state . An attacker controlling multiple sibling target entries can use the instantiate() function to resolve hydra._int...