CVE-2026-106440

Executive Summary

CVE-2026-106440 is a code-injection vulnerability in the hydra-optuna-sweeper package of Hydra, a Python framework for configuring complex applications. From version 1.2.0 until 1.3.0 and 1.4.0.dev10, the package reads a configuration-controlled dotted path from hydra.sweeper.custom_search_space, resolves it via hydra.utils.get_method(), and executes the returned callable inside the Hydra controller process. An attacker who can control the Optuna sweep configuration or supply command-line overrides can cause arbitrary importable Python code to run with the application's privileges, potentially bypassing the trusted execution whitelist on affected Hydra 1.4 development releases. The issue is rated CVSS 3.1 7.8 (High) and is fixed in 1.3.0 and 1.4.0.dev10.

Technical Analysis

The hydra-optuna-sweeper package is an Optuna-based hyperparameter optimization plugin for Hydra. It exposes a configuration key, hydra.sweeper.custom_search_space, which accepts a dotted import path as a string. During a sweep, the package resolves that string to a callable object using hydra.utils.get_method() and then invokes the resolved callable within the Hydra controller process — the same process that orchestrates the application run.

The core defect is a trust-boundary failure, classified as CWE-470 (Use of Externally-Controlled Input to Select Classes or Code / "unsafe reflection"). get_method() is documented as a trusted-input lookup helper: it imports and returns the object named by the dotted path without applying the execution policy that Hydra's instantiate() applies. Hydra's instantiate() enforces controls such as a trusted-execution whitelist and the hydra.utils.call/instantiate semantics that constrain which objects may be constructed and executed. Because the sweeper uses get_method() and then directly invokes its return value, those controls are skipped entirely.

Consequently, the security decision — "which importable Python object at this dotted path should be executed" — is derived from configuration that an attacker may control. Two distinct ingestion vectors exist per the advisory: (1) control over the Optuna sweep configuration itself, and (2) command-line overrides that set or alter the hydra.sweeper.custom_search_space value. In both cases the string flows unmodified into get_method(), which resolves it to a live callable, and the sweeper later calls it in the controller process.

The practical effect is arbitrary code execution in the controller, subject to the constraint that the target must be an importable Python object reachable via dotted path (or otherwise resolvable by get_method()). Because the payload executes in the controller process rather than in a worker or subprocess, it inherits the controller's environment, credentials, file-system access, and network reachability. On affected Hydra 1.4 development releases, the advisory specifically notes that this path can bypass a trusted execution whitelist — that is, code that the whitelist would otherwise block from being executed through instantiate() can still be reached and invoked through the sweeper's get_method() lookup.

No patch diff, commit hash, or CVE-specific fix reference was available in the supplied intelligence. The affected version boundaries are taken verbatim from the advisory: fixed in 1.3.0 and 1.4.0.dev10. No public PoC, exploit code, or Nuclei template was available at the time of writing, and EPSS has not yet assigned a score; the attack chain described below is therefore inferred from the vulnerability class and the advisory wording, not from a published proof of concept.

Exploitation Scenarios

No public exploit code exists for CVE-2026-106440. The following chain is inferred from the advisory description of the mechanism; all named configuration keys and helper functions are those given in the advisory.

1) Reconnaissance / target identification. An attacker identifies a target that runs a Hydra-based application using the hydra-optuna-sweeper plugin, within the affected version range (1.2.0 to <1.3.0, or 1.4.0.dev0 to <1.4.0.dev10). The attacker determines whether they can influence the sweep configuration — for example, through access to a configuration repository, a CI/CD pipeline that renders sweep configs, a shared artifact, or the ability to pass command-line overrides to the Hydra invocation.

2) Triggering the flaw class. The attacker sets hydra.sweeper.custom_search_space to a dotted path of an importable Python object under their control or an otherwise attacker-selected object that can be imported in the target environment. This is an unsafe-reflection trigger (CWE-470): user-controllable input selects the code to be resolved and executed. The insertion point may be the Optuna sweep configuration or a command-line override, per the advisory.

3) Resolution and execution. When the sweep runs, the plugin passes the configured dotted path to hydra.utils.get_method(). That helper resolves the string to the referenced callable. Because get_method() does not apply the execution policy that instantiate() enforces, a trusted execution whitelist is not consulted on affected Hydra 1.4 development releases. The sweeper then invokes the returned callable in the Hydra controller process, executing attacker-selected code with the privileges of that process.

4) Post-exploitation impact. Code executing in the controller process runs with the application's privileges on the host or container running the sweep. Depending on environment, this can enable credential and secrets access, modification of sweep results or model artifacts, lateral movement to systems reachable from the controller, and persistence via modified configuration or jobs. The advisory frames the consequence as arbitrary code execution with the application's privileges; no further specifics are provided.

Impact Assessment

CVSS 3.1 base score is 7.8 (High), vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The subscores indicate: Local attack vector (AV:L), meaning the attacker generally needs local or equivalently close access to the configuration/environment that drives the sweep; Low attack complexity (AC:L), as no special conditions or race conditions are required beyond controlling the configuration input; No privileges required (PR:N); User interaction required (UI:R), consistent with a victim initiating or running a sweep whose configuration has been influenced; Unchanged scope (S:U); and High confidentiality, integrity, and availability impact (C:H/I:H/A:H).

Business impact centers on the integrity and confidentiality of ML/AI training and experimentation pipelines that use Hydra with Optuna sweeps. Because execution occurs in the controller process, an attacker gains the controller's access to training data, model artifacts, cloud credentials, and connected services. For organizations running shared or externally influenced sweep configurations — for example, in multi-tenant research environments or CI pipelines that build from contributed configs — the blast radius extends to any secrets and data reachable by the controller identity. The UI:R and AV:L components mean exploitation is not remotely trivially triggerable without some influence over configuration or a local foothold, but once triggered the impact is severe and complete across the CIA triad.

Detection Guidance

Sigma Rule

title: Hydra Optuna Sweeper Unsafe Custom Search Space Resolution
id: 9f3c1a72-5b4e-4d21-9c8a-7e0d2b6f4a11
status: experimental
description: Detects configuration or command-line references to hydra.sweeper.custom_search_space that may indicate unsafe dotted-path resolution via hydra.utils.get_method in hydra-optuna-sweeper.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106440
author: valtersit.com
logsource:
  category: process_creation
  product: linux
detection:
  selection_cli:
    CommandLine|contains:
      - 'hydra.sweeper.custom_search_space'
      - '+hydra.sweeper.custom_search_space'
      - '~hydra.sweeper.custom_search_space'
  selection_proc:
    Image|endswith: '/python'
  condition: selection_cli and selection_proc
falsepositives:
  - Legitimate use of the custom_search_space feature with vetted, trusted callables
level: medium

YARA Rule

rule CVE_2026_106440_Hydra_Optuna_Custom_Search_Space
{
    meta:
        description = "Detects references to hydra.sweeper.custom_search_space and get_method in Hydra Optuna sweeper configs and code"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106440"
        author = "valtersit.com"
        date = "2026-01-01"
        severity = "high"
    strings:
        $cfg = "hydra.sweeper.custom_search_space" ascii wide
        $getmethod = "get_method" ascii wide
        $sweeper = "hydra-optuna-sweeper" ascii wide
        $instantiate = "instantiate" ascii wide
    condition:
        ($cfg and $getmethod) or ($cfg and $sweeper)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-106440 Hydra Optuna Sweeper custom_search_space override attempt"; flow:established,to_server; content:"hydra.sweeper.custom_search_space"; http_client_body; nocase; classtype:attempted-user; reference:cve,2026-106440; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-106440; sid:2026106440; rev:1;)

Elastic Detection

process where process.name in ("python", "python3") and
  process.args : "*hydra.sweeper.custom_search_space*"

Splunk SPL Query

index=main (sourcetype=linux_audit OR sourcetype=WinEventLog:Security OR source="*process*")
| search ("hydra.sweeper.custom_search_space" OR "hydra-optuna-sweeper")
| table _time host user process_name process_command_line
| sort - _time

Wazuh OSSEC Rule

<group name="hydra,cve_2026_106440,">
  <rule id="1064400" level="10">
    <decoded_as>json</decoded_as>
    <field name="command">\.?hydra.sweeper.custom_search_space</field>
    <description>CVE-2026-106440: Possible Hydra Optuna sweeper custom_search_space unsafe dotted-path override</description>
    <mitre>
      <id>T1204</id>
    </mitre>
  </rule>
  <rule id="1064401" level="12">
    <if_sid>1064400</if_sid>
    <field name="command">get_method</field>
    <description>CVE-2026-106440: Hydra get_method resolution on externally influenced custom_search_space</description>
    <mitre>
      <id>T1204</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations. Treat hydra.sweeper.custom_search_space and all Hydra/Optuna sweep configurations as untrusted input. Prevent untrusted parties from modifying sweep configs or supplying command-line overrides that set hydra.sweeper.custom_search_space. Where the feature is not required, remove or disable it, or block the configuration key at the CI/CD and deployment layer. Run sweeps with least-privilege service identities, no ambient cloud credentials, and restricted network egress so that controller-process code execution has minimal reach. Review which importable callables are legitimately referenced and pin them to a vetted allowlist enforced outside Hydra.

2) Patch/upgrade steps. Upgrade to Hydra 1.3.0 or 1.4.0.dev10 or later, per the advisory's stated fixed versions. Because no patch evidence was available from tracked sources at the time of writing, validate the fixed versions against the vendor project before relying on them, and confirm that the upgrade removes the get_method()-based resolution path from hydra-optuna-sweeper.

3) Long-term hardening. Adopt an execution policy for all config-driven code resolution so that no helper bypasses the trusted-execution whitelist enforced by instantiate(). Review Hydra plugins and third-party integrations for similar uses of get_method() or other trusted-input lookup helpers driven by configuration. Apply supply-chain controls to configuration repositories (signed commits, protected branches, review requirements) and to CI pipelines that render or consume sweep configs. Monitor and alert on changes to hydra.sweeper.custom_search_space and on controller processes invoking dynamically resolved callables.

References

1. NVD — CVE-2026-106440: https://nvd.nist.gov/vuln/detail/CVE-2026-106440
2. Hydra project documentation and repository (vendor): https://github.com/facebookresearch/hydra
3. Hydra hydra.utils.get_method API documentation (trusted-input lookup helper): https://hydra.cc/docs/advanced/instantiate_objects/overview/
4. CWE-470 — Use of Externally-Controlled Input to Select Classes or Code: https://cwe.mitre.org/data/definitions/470.html
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-106440 not listed at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, or exploit-in-the-wild evidence was available. EPSS has not yet scored this CVE. No threat actor campaign has been associated with CVE-2026-106440 at the time of writing.