CVE-2026-115749
Low
Description
hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an arbitrary module import vulnerability via the ray_pkg_version OmegaConf resolver passing input to importlib.import_module(). Attackers controlling configuration values or command-line overrides can supply a ray_pkg_version interpolation to import any installed module, triggering its import-time side effects in the application process.
SeverityLow
CVSS3.3
Exploit probability—
ProductHydra-ecosystem Hydra-ray-launcher
PublishedOct 23, 2026
First seenOct 23, 2026
Weakness typeCWE-470CWE-470
How to fix
Update
- hydra-ecosystem hydra-ray-launcher1.2.2, 1.4.0rc2 or later
Patches
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hydra-ecosystem hydra-ray-launcher | 1.1.0.dev1 ≤ v < 1.2.2, 1.4.0.dev4 ≤ v < 1.4.0rc2 | 1.2.2, 1.4.0rc2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.