CVE-2026-115749: Ray arbitrary module import

CISO Take

hydra-ray-launcher, a Hydra plugin for launching ML jobs on Ray clusters, has a flaw in its ray_pkg_version OmegaConf resolver that passes untrusted input to importlib.import_module(). An attacker who controls configuration values or command-line overrides can force the application to import any installed module and trigger its import-time side effects. Real-world risk is low: the CVSS is 3.3, the attack is local and needs low privileges, and EPSS is not available. The vulnerability is not in CISA KEV, there is no public exploit, no Nuclei template, and no SSVC decision. The practical concern is pipelines where config or overrides come from untrusted sources, such as shared experiment configs, CI-triggered sweeps or user-submitted job parameters. Upgrade to hydra-ray-launcher 1.2.2 or 1.4.0rc2 or later, and treat Hydra configs and CLI overrides as trusted code-adjacent input.

Sources:NVDGitHub AdvisoryVulnCheckATLAS

What is the risk?

Low overall risk. The CVSS 3.1 score is 3.3 (AV:L/AC:L/PR:L/UI:N, integrity impact only). Exploitation needs local access or control over configuration or overrides. There is no known exploitation, no public exploit and no KEV listing, and EPSS is not available. Risk rises in multi-tenant ML platforms or CI systems where untrusted users can submit config overrides, because import-time side effects of installed modules could be abused. The exact impact depends on which modules are installed in the environment, and the advisory only states integrity impact, not code execution.

How does the attack unfold?

Initial Access

Attacker with low privileges supplies a malicious configuration value or command-line override to a Hydra job.

AML.T0112

Exploitation

The ray_pkg_version resolver passes the attacker-controlled string to importlib.import_module(), importing an arbitrary installed module.

AML.T0050

Impact

Import-time side effects of the chosen module run in the application process, causing limited integrity impact.

Initial Access

Attacker with low privileges supplies a malicious configuration value or command-line override to a Hydra job.

AML.T0112

Exploitation

The ray_pkg_version resolver passes the attacker-controlled string to importlib.import_module(), importing an arbitrary installed module.

AML.T0050

Impact

Import-time side effects of the chosen module run in the application process, causing limited integrity impact.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Ray	pip	—	No patch
44.1KOpenSSF 5.7642 dependentsPushed 7d ago65% patched~171d to patchFull package profile →

Do you use Ray? You're affected.

How severe is it?

CVSS 3.1

3.3 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 13% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVLocal

ACLow

PRLow

UINone

SUnchanged

CNone

ILow

ANone

What should I do?

6 steps

Upgrade hydra-ray-launcher to 1.2.2 (stable line) or 1.4.0rc2 or later (pre-release line).
Do not accept configuration files or command-line overrides from untrusted users or external systems when launching Hydra jobs.
In CI and multi-tenant ML platforms, restrict who can set overrides and validate them against an allowlist.
Search configs and job logs for unexpected ${ray_pkg_version:...} interpolations or unusual module names.
Apply least privilege to the accounts and containers running training jobs, so import-time side effects have limited reach.
Review the upstream fix in the linked commit and PR (hydra PR 3566) and advisory GHSA-h34c-q33w-3r7q.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionSupply ChainFrameworkTraining DataAML.T0050- Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Mechanisms to respond to and recover from unknown risks

Frequently Asked Questions

What is CVE-2026-115749?

hydra-ray-launcher, a Hydra plugin for launching ML jobs on Ray clusters, has a flaw in its ray_pkg_version OmegaConf resolver that passes untrusted input to importlib.import_module(). An attacker who controls configuration values or command-line overrides can force the application to import any installed module and trigger its import-time side effects. Real-world risk is low: the CVSS is 3.3, the attack is local and needs low privileges, and EPSS is not available. The vulnerability is not in CISA KEV, there is no public exploit, no Nuclei template, and no SSVC decision. The practical concern is pipelines where config or overrides come from untrusted sources, such as shared experiment configs, CI-triggered sweeps or user-submitted job parameters. Upgrade to hydra-ray-launcher 1.2.2 or 1.4.0rc2 or later, and treat Hydra configs and CLI overrides as trusted code-adjacent input.

Is CVE-2026-115749 actively exploited?

No confirmed active exploitation of CVE-2026-115749 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-115749?

1. Upgrade hydra-ray-launcher to 1.2.2 (stable line) or 1.4.0rc2 or later (pre-release line). 2. Do not accept configuration files or command-line overrides from untrusted users or external systems when launching Hydra jobs. 3. In CI and multi-tenant ML platforms, restrict who can set overrides and validate them against an allowlist. 4. Search configs and job logs for unexpected ${ray_pkg_version:...} interpolations or unusual module names. 5. Apply least privilege to the accounts and containers running training jobs, so import-time side effects have limited reach. 6. Review the upstream fix in the linked commit and PR (hydra PR 3566) and advisory GHSA-h34c-q33w-3r7q.

What systems are affected by CVE-2026-115749?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, ML experiment orchestration, distributed compute (Ray) job launchers, CI/CD for ML.

What is the CVSS score for CVE-2026-115749?

CVE-2026-115749 has a CVSS v3.1 base score of 3.3 (LOW). The EPSS exploitation probability is 0.22%.

What is the AI security impact?

Affected AI Architectures

training pipelinesML experiment orchestrationdistributed compute (Ray) job launchersCI/CD for ML

MITRE ATLAS Techniques

AML.T0050Command and Scripting Interpreter

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an arbitrary module import vulnerability via the ray_pkg_version OmegaConf resolver passing input to importlib.import_module(). Attackers controlling configuration values or command-line overrides can supply a ray_pkg_version interpolation to import any installed module, triggering its import-time side effects in the application process.

Exploitation Scenario

A user with low privileges on a shared ML platform submits a training job with a command-line override containing a ray_pkg_version interpolation that names a module installed in the environment. When Hydra resolves the config, the launcher imports that module with importlib.import_module(), and its import-time side effects run inside the job process. The attacker uses this to trigger unintended behavior, such as a module that modifies state, writes files or initializes network connections. The impact is limited to what the installed modules do on import.

Weaknesses (CWE)

CWE-470Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')Primary CWE-470Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

CWE-470 — Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection'): The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

[Architecture and Design] Refactor your code to avoid using reflection.
[Architecture and Design] Do not use user-controlled inputs to select and load classes or code.

Source: MITRE CWE corpus.