CVE-2026-106442

The Hydra configuration framework is vulnerable to code execution in versions 1.3.4 through 1.3.6 and 1.4.0.dev9 . The instantiate() target blacklist, originally intended to mitigate CVE-2026-68508, fails to sufficiently validate the effective callable selected by the target field. Attackers can ...