CVE-2026-10766
mlrun DataFrame Hash helpers.py mlrun.utils.helpers.calculate_dataframe_hash weak hash
A vulnerability has been found in mlrun up to 1.12.0-rc3. This impacts the function mlrun.utils.helpers.calculate_dataframe_hash of the file mlrun/utils/helpers.py of the component DataFrame Hash Handler. The manipulation leads to use of weak hash. The attack can only be performed from a local environment. The complexity of an attack is rather high. The exploitability is said to be difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
mlrun DataFrame Hash helpers.py mlrun.utils.helpers.calculate_dataframe_hash weak hash
A vulnerability has been found in mlrun up to 1.12.0-rc3. This impacts the function mlrun.utils.helpers.calculate_dataframe_hash of the file mlrun/utils/helpers.py of the component DataFrame Hash Handler. The manipulation leads to use of weak hash. The attack can only be performed from a local environment. The complexity of an attack is rather high. The exploitability is said to be difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.
- Record
CVE-2026-10766- CVSS 4.0
- 2.0 Low
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 3.6 Low
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R - CVSS 3.0
- 3.6 Low
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R - CVSS 2.0
- 2.4
AV:L/AC:H/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR - Weakness
- CWE-328, CWE-327
- Updated
- 2026-11-02
EUVDEUVD-2026-34177
A vulnerability has been found in mlrun up to 1.12.0-rc3. This impacts the function mlrun.utils.helpers.calculate_dataframe_hash of the file mlrun/utils/helpers.py of the component DataFrame Hash Handler. The manipulation leads to use of weak hash. The attack can only be performed from a local environment. The complexity of an attack is rather high. The exploitability is said to be difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.
- Record
EUVD-2026-34177- CVSS 4.0
- 2.0 Low
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-phx2-3w66-h4pw
mlrun: DataFrame hash collisions can cause dataset artifact path conflicts and silent data corruption
A vulnerability has been found in mlrun up to 1.12.0-rc3. This impacts the function mlrun.utils.helpers.calculate_dataframe_hash of the file mlrun/utils/helpers.py of the component DataFrame Hash Handler. The manipulation leads to use of weak hash. The attack can only be performed from a local environment. The complexity of an attack is rather high. The exploitability is said to be difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.
- Record
GHSA-phx2-3w66-h4pw- CVSS 4.0
- 1.1 Low
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 3.6 Low
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L - Weakness
- CWE-327
- Updated
- 2026-11-02
NVD
A vulnerability has been found in mlrun up to 1.12.0-rc3. This impacts the function mlrun.utils.helpers.calculate_dataframe_hash of the file mlrun/utils/helpers.py of the component DataFrame Hash Handler. The manipulation leads to use of weak hash. The attack can only be performed from a local environment. The complexity of an attack is rather high. The exploitability is said to be difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.
- Record
CVE-2026-10766- CVSS 4.0
- 1.1 Low
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 3.6 Low
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L - CVSS 2.0
- 2.4 Low
AV:L/AC:H/Au:S/C:N/I:P/A:P - Weakness
- CWE-327, CWE-328
- Updated
- 2026-11-02
OSV
mlrun DataFrame Hash helpers.py mlrun.utils.helpers.calculate_dataframe_hash weak hash
A vulnerability has been found in mlrun up to 1.12.0-rc3. This impacts the function mlrun.utils.helpers.calculate_dataframe_hash of the file mlrun/utils/helpers.py of the component DataFrame Hash Handler. The manipulation leads to use of weak hash. The attack can only be performed from a local environment. The complexity of an attack is rather high. The exploitability is said to be difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.
- Record
CVE-2026-10766- CVSS 4.0
- 1.1 Low
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P - Weakness
- CWE-327, CWE-328
- Updated
- 2026-11-02
OSVGHSA-phx2-3w66-h4pw
mlrun: DataFrame hash collisions can cause dataset artifact path conflicts and silent data corruption
A vulnerability has been found in mlrun up to 1.12.0-rc3. This impacts the function mlrun.utils.helpers.calculate_dataframe_hash of the file mlrun/utils/helpers.py of the component DataFrame Hash Handler. The manipulation leads to use of weak hash. The attack can only be performed from a local environment. The complexity of an attack is rather high. The exploitability is said to be difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.
- Record
GHSA-phx2-3w66-h4pw- CVSS 4.0
- 1.1 Low
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 3.6 Low
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L - Weakness
- CWE-327
- Updated
- 2026-11-02
OSVPYSEC-2026-3487
mlrun: DataFrame hash collisions can cause dataset artifact path conflicts and silent data corruption
A vulnerability has been found in mlrun up to 1.12.0-rc3. This impacts the function mlrun.utils.helpers.calculate_dataframe_hash of the file mlrun/utils/helpers.py of the component DataFrame Hash Handler. The manipulation leads to use of weak hash. The attack can only be performed from a local environment. The complexity of an attack is rather high. The exploitability is said to be difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.
- Record
PYSEC-2026-3487- CVSS 4.0
- 1.1 Low
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 3.6 Low
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L - Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mlrunPyPI |
through 1.12.0rc3 | None known |
mlrunPyPI |
through 1.12.0rc3, plus listed versions 0.1.60.10.00.10.0rc10.10.0rc20.10.0rc3 Show 45 moreShow less0.10.0rc40.10.0rc50.10.0rc60.10.0rc70.10.0rc80.10.0rc90.10.10.10.1rc10.10.1rc20.10.1rc30.10.1rc40.10.1rc50.10.1rc60.10.1rc70.10.1rc80.10.1rc90.10.2rc10.2.00.2.50.3.00.3.10.3.20.3.30.4.10.4.100.4.30.4.40.4.50.4.60.4.70.4.80.4.90.5.00.5.10.5.1rc10.5.1rc20.5.20.5.2rc10.5.2rc20.5.30.5.3rc10.5.3rc20.5.3rc30.5.40.5.4rc1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-10766 is a low vulnerability (CVSS 2.0) in mlrun, published June 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.07%, the 0th percentile. No source names a fixed version.
References
Left out here: 753 versions. The JSON record has them.