CVE-2026-10766

June 4, 2026, 4:10 p.m.

1.1
Low

Description

A vulnerability has been found in mlrun up to 1.12.0-rc3. This impacts the function mlrun.utils.helpers.calculate_dataframe_hash of the file mlrun/utils/helpers.py of the component DataFrame Hash Handler. The manipulation leads to use of weak hash. The attack can only be performed from a local environment. The complexity of an attack is rather high. The exploitability is said to be difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.

Product(s) Impacted

Vendor Product Versions
Mlrun
  • Mlrun
  • <1.12.0-rc3

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-327
Use of a Broken or Risky Cryptographic Algorithm
The product uses a broken or risky cryptographic algorithm or protocol.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a mlrun mlrun <1.12.0-rc3 / / / / / / /

References

https://github.com/mlrun/mlrun/
https://github.com/mlrun/mlrun/issues/9691
https://github.com/mlrun/mlrun/pull/9692
https://vuldb.com/cve/CVE-2026-10766
https://vuldb.com/submit/831419
https://vuldb.com/vuln/368136
https://vuldb.com/vuln/368136/cti
https://github.com/mlrun/mlrun/issues/9691

Tags

CWE-327
[email protected]
2026-06-03
CVE-2026-10766

CVSS Score

1.1 / 10

CVSS Data - 4.0

  • Attack Vector: LOCAL
  • Attack Complexity: HIGH
  • Attack Requirements: NONE
  • Privileges Required: LOW
  • User Interaction: NONE
  • Scope:
  • Confidentiality Impact: NONE
  • Integrity Impact: LOW
  • Availability Impact: LOW
  • Exploit Maturity: PROOF_OF_CONCEPT

    • CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

    View Vector String

Timeline

Published: June 3, 2026, 8:16 p.m.
Last Modified: June 4, 2026, 4:10 p.m.

Status : Deferred

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

[email protected]

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.