PT-2026-46056 · Mlrun · Mlrun

Dem0 · CVE-2026-10766 · Published 2026-06-03 · Updated 2026-07-23

Positive Technologies (AI Summary)

CVSS v3.1

3.6

Low

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions mlrun versions prior to 1.12.0-rc3

Description The DataFrame Hash Handler component contains an issue in the calculate dataframe hash() function within the mlrun/utils/helpers.py file. This allows for the use of a weak hash, which can be manipulated. Exploitation requires a local environment and is characterized by high complexity and difficult exploitability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-328

CWE-327

Related Identifiers

CVE-2026-10766

GHSA-PHX2-3W66-H4PW

PYSEC-2026-3487

Affected Products

Mlrun

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10766.json · Exploit
• 🔥 https://github.com/mlrun/mlrun/issues/9691 · Exploit
• https://github.com/mlrun/mlrun/pull/9692 · Patch
• https://osv.dev/vulnerability/GHSA-phx2-3w66-h4pw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-10766 · Security Note
• https://osv.dev/vulnerability/CVE-2026-10766 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-3487 · Vendor Advisory
• https://github.com/mlrun/mlrun · Note
• https://vuldb.com/vuln/368136 · Note
• https://vuldb.com/vuln/368136/cti · Note
• https://t.me/CVEtracker/55760 · Telegram Post
• https://vuldb.com/submit/831419 · Note
• https://github.com/advisories/GHSA-phx2-3w66-h4pw · Note
• https://twitter.com/VulmonFeeds/status/2062428069281878328 · Twitter Post
• https://pypi.org/project/mlrun · Note