CVE-2026-10766

LOW

mlrun DataFrame Hash helpers.py mlrun.utils.helpers.calculate_dataframe_hash weak hash

Title source: cna
STIX 2.1

Description

A vulnerability has been found in mlrun up to 1.12.0-rc3. This impacts the function mlrun.utils.helpers.calculate_dataframe_hash of the file mlrun/utils/helpers.py of the component DataFrame Hash Handler. The manipulation leads to use of weak hash. The attack can only be performed from a local environment. The complexity of an attack is rather high. The exploitability is said to be difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.

References (7)

Core 7
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-368136 | mlrun DataFrame Hash helpers.py mlrun.utils.helpers.calculate_dataframe_hash weak hash
https://vuldb.com/vuln/368136
Signature, Permissions Required signature permissions-required
VDB-368136 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/368136/cti
Third Party Advisory third-party-advisory
CVE-2026-10766 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-10766
Third Party Advisory third-party-advisory
Submit #831419 | mlrun v1.12.0-rc3 Hash Collision
https://vuldb.com/submit/831419
Exploit exploit issue-tracking
https://github.com/mlrun/mlrun/issues/9691
Patch issue-tracking patch
https://github.com/mlrun/mlrun/pull/9692

Scores

CVSS v3 3.6
EPSS 0.0008
EPSS Percentile 0.1%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-327 CWE-328
Status published
Products (3)
None/mlrun 1.12.0-rc1
None/mlrun 1.12.0-rc2
None/mlrun 1.12.0-rc3
Published Jun 03, 2026
Tracked Since Jun 04, 2026