CVE-2026-115749 Details
Description
hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an arbitrary module import vulnerability via the ray_pkg_version OmegaConf resolver passing input to importlib.import_module(). Attackers controlling configuration values or command-line overrides can supply a ray_pkg_version interpolation to import any installed module, triggering its import-time side effects in the application process.
A vulnerability allowing arbitrary module imports has been identified in the hydra-ray-launcher plugin versions 1.1.0.dev1 prior to 1.2.2 and 1.4.0.dev4 prior to 1.4.0rc2. The issue arises from the ray_pkg_version OmegaConf resolver, which passes input to importlib.import_module(). This vulnerability can be exploited by attackers who control configuration values or command-line overrides, allowing them to import any installed module and trigger its import-time side effects in the application process.
Upgrade hydra-ray-launcher to version 1.2.2 or 1.4.0rc2, depending on the release line in use. If an immediate upgrade is not possible, uninstall the plugin if it is not needed and restart the application, or restrict externally controlled configuration.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 23, 2026CISA-ADP
Assessed Oct 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/hydra-ecosystem/hydra/commit/46e2fdaecd54dbfc041616b1229bd1614b73d765 | [email protected] | Source CodeVendor |
| https://github.com/hydra-ecosystem/hydra/pull/3566 | [email protected] | Issue TrackingSource CodeVendor |
| https://github.com/hydra-ecosystem/hydra/security/advisories/GHSA-h34c-q33w-3r7q | [email protected] | AdvisoryRemedyVendor |
| https://pypi.org/project/hydra-ray-launcher/1.2.2/ | [email protected] | ProductVendor |
| https://www.vulncheck.com/advisories/hydra-ray-launcher-1.1.0-dev1-before-1.2.2-and-1.4.0-dev4-before-1.4-0rc2-arbitrary-module-import | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-470 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| hydra-ray-launcher | >= 1.1.0.dev1, < 1.2.2 >= 1.4.0.dev4, < 1.4.0rc2 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 23, 2026 | CVE Modified | CISA-ADP |
| Oct 23, 2026 | New CVE Received | [email protected] |