CVE-2026-10804: 
NixOS vulnerability analysis and mitigation

CVE-2026-10804 is a weak hash vulnerability in Streamlit's caching mechanism (lib/streamlit/runtime/caching/hashing.py) that allows a local, low-privileged attacker to cause cache key collisions, resulting in stale or incorrect data being served to users. It affects Streamlit versions up to and including 1.53.0 (by Snowflake). The vulnerability was disclosed on June 4, 2026, and is classified as CWE-327 (Use of a Broken or Risky Cryptographic Algorithm) and CWE-328 (Use of Weak Hash). It carries a CVSS v3.1 base score of 4.7 (Medium) per NIST NVD, and a CVSS v4.0 score of 1.1 (Low) per the CNA (Github Advisory, Streamlit Issue).

Two distinct hash collision bugs exist in lib/streamlit/runtime/caching/hashing.py. Bug 1 (Fixed Sampling Seed): When large data structures exceed sampling thresholds (e.g., >50,000 rows for Pandas, >500,000 elements for NumPy), the code samples a subset before hashing using a hardcoded seed of 0 (random_state=0, seed=0, RandomState(0)). Because the seed is globally fixed and known, an attacker can pre-compute which indices will be sampled and craft two structurally different inputs that produce identical hashes by only modifying non-sampled positions. Bug 2 (PIL P-mode Palette Omission): For palette-indexed (mode="P") PIL images, tobytes() returns only pixel indices, not the color table. Two images with identical pixel indices but different palettes produce the same hash despite being visually distinct. The proposed fix (PR #14635) replaces hardcoded seeds with data-dependent seeds and prepends palette bytes for P-mode images before hashing (Streamlit Issue, Streamlit PR).

Successful exploitation allows a local, low-privileged attacker to poison the @st.cache_data or @st.cache_resource cache by crafting inputs that collide with legitimate cache keys. Since @st.cache_resource is shared across all user sessions, a single adversarial request can cause all subsequent users to receive the attacker's manipulated data instead of the correct result — with no error raised. The primary impact is data integrity compromise (unauthorized modification of cached values), with potential secondary availability impact through service disruption caused by incorrect cached results. There is no confidentiality impact (Streamlit Issue, Github Advisory).

The vulnerability requires local access and low privileges, with high attack complexity, making it difficult to exploit in practice. The EPSS score is approximately 0.006% (0th percentile), indicating a very low probability of exploitation in the wild. A proof-of-concept has been publicly disclosed in the GitHub issue (including minimal reproduction code for NumPy and Pandas), but there is no evidence of in-the-wild exploitation or threat actor attribution. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Streamlit Issue, Github Advisory).

1. Reconnaissance: Identify a target Streamlit application (version ≤ 1.53.0) that uses @st.cache_data or @st.cache_resource with large NumPy arrays (>500,000 elements), large Pandas/Polars DataFrames (>50,000 rows), or PIL P-mode images.
2. Determine sampled indices (Fixed Seed Bug): Since the sampling seed is hardcoded to 0, pre-compute which indices will be sampled using np.random.RandomState(0).choice(np.arange(total), size=_NP_SAMPLE_SIZE) for NumPy, or df.sample(n=_PANDAS_SAMPLE_SIZE, random_state=0).index for Pandas.
3. Craft colliding payload: Create a malicious data structure that differs from the legitimate input only at non-sampled positions (positions not included in the fixed sample). This ensures the hash of the malicious input matches the hash of the legitimate input.
4. Poison the cache: Submit the crafted payload to the Streamlit application as a local user. The application computes the same cache key for the malicious input as for the legitimate input, storing the attacker's result in the cache.
5. Impact delivery: All subsequent users requesting the same cached function receive the attacker's manipulated data instead of the correct result, with no error or warning raised.
6. PIL P-mode variant: For image-based caches, craft two PIL P-mode images with identical pixel index arrays but different color palettes. Submit the malicious image first to populate the cache; subsequent requests with the legitimate image will return the attacker's cached result (Streamlit Issue).

• Application Behavior: Unexpected or incorrect data returned by Streamlit cached functions (@st.cache_data, @st.cache_resource) without any application errors or cache invalidation events.
• Logs: Streamlit application logs showing cache hits for inputs that should logically produce different outputs; absence of cache miss events when data inputs have changed.
• File System: Unexpected or anomalous cache files in the Streamlit cache directory (typically ~/.streamlit/cache/) with timestamps inconsistent with legitimate application usage.
• Process: Local processes running under low-privilege accounts submitting large array or DataFrame inputs to the Streamlit application, particularly inputs that are structurally similar to known legitimate inputs but differ only in non-leading positions.

A fix has been submitted as PR #14635 to the Streamlit repository, which replaces hardcoded sampling seeds with data-dependent seeds for Pandas, Polars, and NumPy large-object hashing, and prepends palette bytes for PIL P-mode images. As of the disclosure date, the pull request was awaiting acceptance and merge. Users should monitor the Streamlit GitHub repository for the release of a patched version and upgrade as soon as one is available. As interim mitigations: restrict local access to systems running Streamlit (particularly limiting low-privilege user access), implement input validation and integrity checks on cached data, and consider clearing the Streamlit cache periodically in sensitive deployments (Streamlit PR, Github Advisory).

The vulnerability was reported by researcher 3em0 via a detailed GitHub issue on April 3, 2026, with clear proof-of-concept code and impact analysis. The Streamlit team confirmed the bug (labeling it status:confirmed, area:security, priority:P3) and a community contributor (mserdukoff) submitted a fix PR on April 4, 2026. Automated AI code review (Claude, Gemini, GPT) unanimously approved the fix as well-structured, with minor test robustness suggestions. The issue received positive community engagement, with reviewers noting it as a subtle but important caching bug (Streamlit Issue, Streamlit PR).