CVE-2026-106441

Executive Summary

CVE-2026-106441 is a code injection vulnerability in Hydra, the Python framework for configuring complex applications. Prior to versions 1.3.6 and 1.4.0.dev9, Hydra forwards Python logging configuration directly into logging.config.dictConfig() without applying its internal target policy to handler class values or to formatter, filter, handler, queue, and listener factories. An attacker who can control the Hydra logging configuration can specify an arbitrary importable class or factory that is then invoked with the privileges of the running application, bypassing the protection Hydra applies on the instantiate() path. The issue is rated 7.8 (High) with High confidentiality, integrity, and availability impact, and affects any deployment where logging configuration originates from an untrusted or partially trusted source.

Technical Analysis

The core of this vulnerability is an asymmetry in Hydra's object-instantiation safety model. Hydra implements a "target policy" — a mechanism that constrains which importable targets may be instantiated from configuration. On documented paths, that policy is enforced through instantiate(). However, Hydra also supports configuration-driven Python logging setup, and this path constructs and configures logging objects through logging.config.dictConfig() rather than through instantiate().

Because dictConfig() performs its own reflective class resolution, Hydra's target policy is never consulted. The description notes that Hydra passes logging configuration to logging.config.dictConfig() without applying the target policy to:

• handler class values — the dotted path naming the handler class to construct;
• formatter factories — callables that build logging.Formatter instances;
• filter factories — callables that build logging filters;
• handler factories — callables that build handlers;
• queue factories — callables that build queue objects used by queue-based handlers (e.g., QueueHandler/QueueListener configurations);
• listener factories — callables that build queue listeners.

logging.config.dictConfig() resolves each of these by importing the named object and calling it, in many cases with arguments drawn from the same configuration dict. The object is therefore invoked under the process's identity — the same privilege level as the Hydra application itself. This constitutes code execution from configuration (CWE-94), because configuration values are treated as executable references rather than inert data.

Critically, the description emphasizes that this is exploitable "even in versions where instantiate() is protected because the logging path does not use instantiate()." In other words, defenses applied to the normal Hydra instantiation flow do not extend to the logging flow. An operator who hardened instantiate() behavior, or a version in which the target policy is otherwise enforced, is still exposed through logging.config.dictConfig().

Attack surface: any interface by which an attacker can influence Hydra's logging configuration reached by the application — for example externalized config files, config served from a remote or shared location, or any input that is merged into the logging configuration tree. The CVSS vector reflects a local attack vector with no special privileges (AV:L/PR:N) but a required user interaction (UI:R), consistent with an attacker who plants or supplies configuration that the application later loads. All three impact metrics are High, reflecting full read/write/denial potential once an arbitrary callable is invoked in-process.

No public proof-of-concept, exploit code, or Nuclei template is known for this CVE.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (code injection via configuration-driven dictConfig() reflection) and the specific description provided.

1. Reconnaissance / target identification. The attacker identifies a target application that uses Hydra and whose logging configuration is derived from a source the attacker can reach or influence — for example a configuration file the attacker can write or replace, a config artifact pulled from a shared/remote location, or any workflow in which logging config is merged from partially trusted input. No network fingerprint is required; the attacker's objective is controlling the logging configuration tree that the victim process will feed to logging.config.dictConfig().

2. Triggering the flaw class. The attacker crafts logging configuration entries for handler class values, or for formatter, filter, handler, queue, or listener factories, that point to an attacker-chosen importable object instead of a legitimate logging class. Because Hydra does not apply its target policy on this path, the value is accepted and passed into logging.config.dictConfig().

3. Execution method (vulnerability-class level). logging.config.dictConfig() imports the referenced object and invokes it (directly or as a factory) while constructing the logging subsystem. The referenced callable therefore executes inside the victim process at the application's privilege level. The attacker does not need to supply shell syntax; supplying the class/factory reference itself is the payload.

4. Post-exploitation impact. Because the invoked object runs in-process with the application's privileges, the attacker achieves confidentiality, integrity, and availability impact: reading secrets and configuration, modifying application behavior or data, and disrupting the service. Given AV:L/PR:N/UI:R at CVSS 7.8, the realistic exploitation pattern is a local actor (or supply-chain/config-tampering actor) who plants configuration that a user-initiated run later processes.

Note: exploitation requires the ability to control Hydra logging configuration; this CVE is not remotely triggerable by itself and has no known in-the-wild exploitation or CISA KEV listing as of this report.

Impact Assessment

CVSS 3.1 base score is 7.8 (High) — CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

• Confidentiality: High. An arbitrary imported callable executes in the application's context and can read environment variables, credentials, config secrets, and application data.
• Integrity: High. The same primitive permits modification of application state, data, or behavior at runtime.
• Availability: High. Arbitrary in-process code can terminate, hang, or destabilize the service.
• Scope: Unchanged. Impact is confined to the security authority of the vulnerable Hydra application (no assumption of crossing a privilege boundary beyond that of the process).
• Attack vector / complexity / privileges / interaction. Local attack vector, low complexity, no privileges required, and User Interaction Required — consistent with an attacker who must get configuration loaded by a victim process.
• Blast radius. Every application embedding Hydra with an attacker-influenceable logging config is in scope. Because Hydra is a widely used configuration framework in Python/ML tooling and research pipelines, the affected surface is broad, but exploitation is gated on controlling the logging configuration source. There is no EPSS score recorded (not yet scored by FIRST.org), and the CVE is not in the CISA KEV catalog.

Detection Guidance

Sigma Rule

title: Hydra Logging Configuration Abuse via dictConfig Reflective Factory
id: 8f3a1c2e-6b47-4d9a-9e21-0c7f5a2d4b10
status: experimental
description: Detects process behavior consistent with CVE-2026-106441, where Hydra passes logging configuration to logging.config.dictConfig() and resolves handler classes or formatter/filter/handler/queue/listener factories without applying Hydra's target policy, enabling invocation of attacker-selected importable objects.
author: valtersit.com Threat Intelligence
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106441
logsource:
  category: process_creation
  product: linux
detection:
  selection_proc:
    Image|endswith:
      - '/python'
      - '/python3'
    CommandLine|contains:
      - 'hydra'
      - 'dictConfig'
  selection_file:
    TargetFilename|contains:
      - 'logging.yaml'
      - 'logging.yml'
      - 'logging.json'
      - 'logging.conf'
  condition: selection_proc and selection_file
fields:
  - CommandLine
  - Image
  - ParentImage
  - User
falsepositives:
  - Legitimate deployments that ship and load logging configuration from a trusted, version-controlled location
level: medium
tags:
  - attack.t1059
  - cve.2026.106441

YARA Rule

rule CVE_2026_106441_Hydra_Logging_DictConfig
{
    meta:
        description = "Detects logging configuration content referencing reflective class/factory resolution consistent with CVE-2026-106441 in Hydra"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106441"
        date = "2026-01-01"
        severity = "high"

    strings:
        $d1 = "dictConfig"
        $d2 = "class:" ascii
        $d3 = "()" ascii
        $f1 = "formatter" nocase
        $f2 = "filter" nocase
        $f3 = "handler" nocase
        $f4 = "queue" nocase
        $f5 = "listener" nocase
        $y1 = "logging" nocase

    condition:
        ($d1 or $y1) and $f1 and $f3 and $f2 and
        ($f4 or $f5) and
        filesize < 1MB
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-106441 Possible Hydra Logging Configuration Retrieval (handler/formatter/filter factories)"; flow:established,to_client; content:"dictConfig"; nocase; content:"formatter"; nocase; content:"handler"; nocase; content:"filter"; nocase; pcre:"/(class|factory)/i"; classtype:attempted-user; reference:cve,2026-106441; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-106441; sid:2026106441; rev:1;)

Elastic Detection

process where event.type == "start" and
process.name in ("python", "python3") and
(
  process.command_line : "*hydra*" or
  process.command_line : "*dictConfig*" or
  process.command_line : "*logging.yaml*" or
  process.command_line : "*logging.yml*"
) and
(
  file.name : ("logging.yml" or "logging.yaml" or "logging.json" or "logging.conf")
)

Splunk SPL Query

index=main sourcetype=linux_audit OR sourcetype=sysmon OR sourcetype=process
| search (process_name=python OR process_name=python3)
| search command_line IN ("*hydra*","*dictConfig*","*logging.yaml*","*logging.yml*","*logging.json*")
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, process_name, command_line, parent_process_name
| where count >= 1
| sort - first_seen

Wazuh OSSEC Rule

<group name="hydra,cve-2026-106441,">
  <rule id="1064411" level="12">
    <if_sid>530</if_sid>
    <field name="audit.command">python3?</field>
    <match>hydra|dictConfig|logging\.ya?ml|logging\.json</match>
    <description>CVE-2026-106441: Potential Hydra logging configuration abuse - dictConfig reflective factory resolution detected</description>
    <mitre>
      <id>T1059</id>
    </mitre>
    <group>cve_2026_106441,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix file, OSV package mapping, workaround note, or affected-version list was supplied by any tracked source. The remediation version boundaries below are taken verbatim from the NVD description and are advisory targets, not confirmed tracked patches.

1. Immediate mitigations.

   • Treat Hydra logging configuration as security-sensitive input. Restrict write access and provenance for any file, remote source, or merged config tree that populates logging settings; load logging config only from a trusted, version-controlled location.
   • Where feasible, avoid passing attacker-influenceable configuration to logging.config.dictConfig(). Prefer programmatic logging setup or a strict allowlist of permitted handler classes and formatter/filter/handler/queue/listener factories.
   • Enforce external input validation on logging configuration — reject class/factory references that do not match an expected allowlist of legitimate logging classes and callables.
   • Apply least privilege to Hydra application processes so that any accidentally invoked callable executes with minimal authority.
   • Monitor configuration files and remote config endpoints for unauthorized modification patterns consistent with the detection rules above.

2. Patch / upgrade steps.

   • Upgrade to Hydra 1.3.6 or 1.4.0.dev9 or later, per the NVD description. These versions apply Hydra's target policy to logging handler class values and to formatter, filter, handler, queue, and listener factories, closing the gap between the logging path and the protected instantiate() path.
   • Verify the installed version before upgrading and confirm the resolved package origin (supply-chain verification of the Hydra package).
   • Patch confidence remains 0/4 pending confirmation from the upstream project; validate the fix in a staging environment before fleet-wide rollout.

3. Long-term hardening.

   • Extend target-policy enforcement to all configuration-driven reflective resolution paths, including logging integration, to eliminate the "protected via instantiate() but not elsewhere" asymmetry that produced this CVE.
   • Add regression tests asserting that malicious handler classes and factories in logging configuration are rejected.
   • Adopt configuration-integrity controls (signing or checksum verification of loaded config) and continuous dependency monitoring for Hydra advisories.
   • Inventory Hydra usage across ML/AI pipelines and Python services, since these are the primary consumers of the framework.

References

• NVD — CVE-2026-106441: https://nvd.nist.gov/vuln/detail/CVE-2026-106441
• Python Standard Library — logging.config.dictConfig documentation: https://docs.python.org/3/library/logging.config.html
• Hydra project documentation and repository (upgrade target 1.3.6 / 1.4.0.dev9): https://hydra.cc
• CWE-94 — Improper Control of Generation of Code ('Code Injection'): https://cwe.mitre.org/data/definitions/94.html
• CISA Known Exploited Vulnerabilities Catalog (CVE not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, Nuclei template, or known threat actor campaign has been identified for CVE-2026-106441. EPSS has not yet been scored by FIRST.org, and the CVE is not in CISA KEV.