Live › vulnerability › CVE-2026-115749
Go to dashboardhydra-ray-launcher passes a configuration value straight into importlib.import_module() through its ray_pkg_version OmegaConf resolver. An attacker who controls config values or command-line overrides can import any installed module and trigger its import-time side effects inside the application process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams using hydra-ray-launcher versions up to or up to are exposed. Exposure requires that config values or command-line overrides come from someone who should not control them, so teams that only use fixed, locally written configs have much lower risk.
1.1.0.dev11.2.21.4.0.dev41.4.0rc2No product ranges from the sources yet.
pip show hydra-ray-launcher to see the installed version.ray_pkg_version interpolations, for example ${ray_pkg_version:...}.1.2.2 on the 1.x line, or to 1.4.0rc2 on the 1.4 development line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an arbitrary module import vulnerability via the ray_pkg_version OmegaConf resolver passing input to importlib.import_module(). Attackers controlling configuration values or command-line overrides can supply a ray_pkg_version interpolation to import any installed module, triggering its import-time side effects in the application process.
This page as .md · .json · in your agent: get_signal("CVE-2026-115749")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.