PT-2026-46190 · Streamlit · Streamlit

Dem0 · CVE-2026-10804 · Published 2026-06-04 · Updated 2026-06-10

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Streamlit versions prior to 1.53.0

Description An issue exists in the Palette Handler component within the lib/streamlit/runtime/caching/hashing.py library. Manipulation of an unknown function in this library can lead to the use of a weak hash. This attack requires local access and is characterized by high complexity and difficult exploitability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

CWE-328

Related Identifiers

CVE-2026-10804

GHSA-VQWP-45WM-R9R5

PYSEC-2026-212

Affected Products

Streamlit

References · 16

• 🔥 https://github.com/streamlit/streamlit/issues/14622 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10804.json · Exploit
• https://github.com/streamlit/streamlit/pull/14635 · Patch
• https://osv.dev/vulnerability/GHSA-vqwp-45wm-r9r5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-10804 · Security Note
• https://osv.dev/vulnerability/CVE-2026-10804 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-212 · Vendor Advisory
• https://github.com/streamlit/streamlit · Note
• https://github.com/streamlit/streamlit/commit/fec0f584dae9261abed16cad35b32922104bb933 · Note
• https://github.com/streamlit/streamlit/pull/15397 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/streamlit/PYSEC-2026-212.yaml · Note
• https://t.me/cveNotify/166898 · Telegram Post
• https://vuldb.com/submit/831508 · Note
• https://vuldb.com/vuln/368253 · Note
• https://vuldb.com/cve/CVE-2026-10804 · Note