Ory Hydra vulnerabilities

• cardano-scaling hydra Hydra: Deposit Claim omits Head state-token spending requirement CVE-2026-62162 8.2 HighOctober 30, 2026
• hydra-ecosystem hydra Hydra instantiate target blacklist bypasses permit code execution CVE-2026-106442 Fix available 7.8 HighOctober 6, 2026
• hydra-ecosystem hydra Hydra logging configuration permits unsafe callable resolution CVE-2026-106441 Fix available 7.8 HighOctober 6, 2026
• hydra-ecosystem hydra Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method CVE-2026-106440 Fix available 7.8 HighOctober 6, 2026
• hydra-ecosystem hydra Hydra: Mutable instantiate policy sets allow target blocklist bypass CVE-2026-106439 Fix available 8.5 HighOctober 6, 2026
• facebookresearch hydra Hydra: hydra.utils.instantiate with untrusted config can lead to code execution CVE-2026-68508 Fix available 7.8 HighAugust 21, 2026
• ory hydra Ory Hydra has a SQL injection via forged pagination tokens CVE-2026-33504 Fix available 7.2 HighMarch 20, 2026
• nixos hydra Hydra missing authentication when triggering evaluations through GitHub and Gitea plugins CVE-2025-54864 6.9 MediumAugust 12, 2025
• nixos hydra Hydra persistent XSS in build metrics CVE-2025-54800 7.1 HighAugust 12, 2025
• cardano-scaling hydra hydra-node dangerously assumes L1 event finality and does not consider failed transactions CVE-2025-48886 4.8 MediumJune 19, 2025
• nixos hydra Hydra no restricted eval after nix-eval-jobs migration CVE-2025-32435 2.6 LowApril 15, 2025
• nixos hydra Nix Hydra Missing authentication when triggering evaluations CVE-2024-45049 7.5 HighAugust 27, 2024
• nixos hydra Hydra has persistent XSS vulnerability serving HTML build outputs CVE-2024-32657 4.6 MediumApril 22, 2024
• input-output-hk hydra Malicious head initialiser can extract PTs from control of Hydra scripts, leading to locked participant commits or spoofed commits CVE-2023-42449 8.1 HighOctober 4, 2023
• input-output-hk hydra Hydra's contestation period in head datum can be modified during Close transaction, allowing malicious participant to freely modify the contestation deadline CVE-2023-42448 8.1 HighOctober 4, 2023
• input-output-hk hydra Hydra's committed UTxOs at Commit validator and UTxOs at Initial validator can be spent arbitrarily by anyone CVE-2023-38701 9.1 CriticalOctober 4, 2023
• input-output-hk hydra Snapshot signature not including HeadID will allow replay attacks CVE-2023-42806 6.5 MediumSeptember 21, 2023
• ory hydra Disallow replay of `private_key_jwt` by blacklisting JTIs in Hydra CVE-2020-5300 Fix available 5.8 MediumApril 6, 2020
• ory hydra Hydra has Reflected XSS via error_hint parameter CVE-2019-8400 Fix available 6.1 MediumFebruary 17, 2019