CVE-2026-10766: Use of Weak Hash in mlrun
A vulnerability has been found in mlrun up to 1.12.0-rc3. This impacts the function mlrun.utils.helpers.calculate_dataframe_hash of the file mlrun/utils/helpers.py of the component DataFrame Hash Handler. The manipulation leads to use of weak hash. The attack can only be performed from a local environment. The complexity of an attack is rather high. The exploitability is said to be difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.
AI Analysis
Technical Summary
This vulnerability in mlrun up to version 1.12.0-rc3 involves the use of a weak cryptographic hash function in the calculate_dataframe_hash function within mlrun/utils/helpers.py. The weakness could potentially allow an attacker with local access to manipulate or influence hash calculations, though the attack complexity is high and exploitability is difficult. The vulnerability has been publicly disclosed, and a pull request for a fix is pending acceptance. There is no official patch or remediation released at this time.
Potential Impact
The impact is limited due to the requirement for local access and the high complexity of exploitation. The weak hash usage could undermine data integrity checks relying on this hash, but no direct remote exploitation or privilege escalation is indicated. The CVSS score of 2.0 and low severity reflect the limited impact and difficulty of exploitation.
Mitigation Recommendations
No official patch or fix is currently available. A pull request addressing the issue is awaiting acceptance. Users should monitor the mlrun project for updates and apply the fix once it is officially released. Until then, restricting local access to trusted users and environments can reduce risk.
CVE-2026-10766: Use of Weak Hash in mlrun
Description
A vulnerability has been found in mlrun up to 1.12.0-rc3. This impacts the function mlrun.utils.helpers.calculate_dataframe_hash of the file mlrun/utils/helpers.py of the component DataFrame Hash Handler. The manipulation leads to use of weak hash. The attack can only be performed from a local environment. The complexity of an attack is rather high. The exploitability is said to be difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.
CVSS v4.0
Score 2.0low
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in mlrun up to version 1.12.0-rc3 involves the use of a weak cryptographic hash function in the calculate_dataframe_hash function within mlrun/utils/helpers.py. The weakness could potentially allow an attacker with local access to manipulate or influence hash calculations, though the attack complexity is high and exploitability is difficult. The vulnerability has been publicly disclosed, and a pull request for a fix is pending acceptance. There is no official patch or remediation released at this time.
Potential Impact
The impact is limited due to the requirement for local access and the high complexity of exploitation. The weak hash usage could undermine data integrity checks relying on this hash, but no direct remote exploitation or privilege escalation is indicated. The CVSS score of 2.0 and low severity reflect the limited impact and difficulty of exploitation.
Mitigation Recommendations
No official patch or fix is currently available. A pull request addressing the issue is awaiting acceptance. Users should monitor the mlrun project for updates and apply the fix once it is officially released. Until then, restricting local access to trusted users and environments can reduce risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-06-03T15:40:30.561Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a208c1fe29bf47b50e773e3
Added to database: 6/3/2026, 8:18:39 PM
Last enriched: 6/3/2026, 8:34:00 PM
Last updated: 6/4/2026, 4:50:57 AM
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.