CVE-2026-10766

LOW EPSS 0.1%

Published Jun 3, 20263w ago · Modified Jun 17, 20261w ago

1.1 CVSS 4.0

Low

Published Jun 3, 2026 3w ago

Last Modified Jun 17, 2026 1w ago

Description

A vulnerability has been found in mlrun up to 1.12.0-rc3. This impacts the function mlrun.utils.helpers.calculate_dataframe_hash of the file mlrun/utils/helpers.py of the component DataFrame Hash Handler. The manipulation leads to use of weak hash. The attack can only be performed from a local environment. The complexity of an attack is rather high. The exploitability is said to be difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.

CVSS Details

Base Score

1.1

Exploitability

—

Impact

—

Vector string

CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector Local

Attack Complexity High

Privileges Required Low

User Interaction None

Scope X

Threat Intelligence

EPSS Exploit Probability

0.1% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 2

CWE-327

CWE-328

References 7

github.com https://github.com/mlrun/mlrun/
github.com https://github.com/mlrun/mlrun/issues/9691
github.com https://github.com/mlrun/mlrun/pull/9692
vuldb.com https://vuldb.com/cve/CVE-2026-10766
vuldb.com https://vuldb.com/submit/831419
vuldb.com https://vuldb.com/vuln/368136
vuldb.com https://vuldb.com/vuln/368136/cti

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.