CVE-2026-10766: MLRun DataFrame Hash Weakness (CVSS 3.6)

Technical summary

CVE-2026-10766 affects the calculate_dataframe_hash function within MLRun's helper utilities. The issue stems from reliance on weak or deprecated cryptographic hash algorithms (CWE-327: Use of Broken or Risky Cryptographic Algorithm) combined with improper hash validation logic (CWE-328: Use of Insufficiently Random Values). The vulnerability requires local access (AV:L), high attack complexity (AC:H), and low privileges (PR:L), meaning an authenticated local user must invest considerable effort to exploit it. The impact is limited to integrity degradation and potential availability disruption rather than confidentiality breach.

Business impact

For organizations using MLRun in data processing pipelines, this vulnerability could undermine data integrity controls. If an attacker exploits weak hash collision or forgery, they might cause MLRun to accept tampered dataframes as valid, leading to corrupted analytics, incorrect model training, or poisoned downstream outputs. The risk is primarily relevant in multi-tenant or shared-infrastructure scenarios where local access can be obtained. Most isolated, single-user deployments face minimal practical risk given the high attack complexity and privilege requirements.

Affected systems

MLRun versions through 1.12.0-rc3 are vulnerable. The issue resides specifically in the DataFrame Hash Handler component. Verify your MLRun installation version against the official MLRun releases. Importantly, no vendor product information was available in advisory databases at the time of publication, so check the MLRun project repository and release notes for clarification on affected versions and any interim mitigations.

Exploitability

Public exploit details exist, but actual exploitation remains difficult in practice. An attacker must already possess local system access and valid authentication credentials to interact with MLRun. The attack complexity is rated high, reflecting the non-trivial effort required to craft a collision or forge a valid hash under the weak algorithm. The scenario requiring both local presence and authenticated status significantly constrains real-world attack surfaces in typical cloud or SaaS deployments.

Remediation

Upgrade MLRun to a version newer than 1.12.0-rc3 once a stable patch is released. A pull request addressing this issue is currently pending acceptance into the codebase. Monitor the official MLRun GitHub repository for the merge and subsequent release. Until a patch is available, restrict local access to MLRun systems and apply principle of least privilege to accounts that interact with DataFrame operations.

Patch guidance

Watch the MLRun project repository and release notifications for a version that incorporates the pending pull request. When released, test the patched version in a non-production environment to verify compatibility with your data pipelines and configurations. Given the low severity rating, patching can typically be scheduled during standard maintenance windows rather than treated as emergency remediation. Coordinate upgrade timing with any downstream systems that depend on MLRun's hashing behavior to avoid unexpected validation changes.

Detection guidance

Monitor for calls to calculate_dataframe_hash with unusual or repeated parameter variations, which could indicate hash collision attempts. Log authentication and local access to systems running MLRun, especially from service accounts or non-standard users. Implement file integrity monitoring on mlrun/utils/helpers.py to detect unauthorized modifications. In data processing logs, watch for unexpected dataframe validation failures or acceptance of previously rejected data, which might signal exploitation attempts.

Why prioritize this

Despite public disclosure, this vulnerability merits medium-term but not immediate action. The CVSS 3.1 score of 3.6 (LOW severity) reflects the requirement for local access, high attack complexity, and limited impact scope. Prioritize patching if: (1) your MLRun deployment is on shared or multi-tenant infrastructure where local access is feasible, (2) dataframe integrity is critical to downstream compliance or model accuracy, or (3) you maintain strict vulnerability thresholds. Isolated, single-user research or development instances can defer patching until a stable release cycle.

Risk score, explained

The CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L vector produces a score of 3.6. Local attack vector (AV:L) and required privileges (PR:L) sharply restrict the threat model. High attack complexity (AC:H) means only skilled attackers with specific knowledge can succeed. The absence of confidentiality impact (C:N) and presence of only minor integrity and availability impacts (I:L, A:L) keep severity low. This is appropriate for a weak hashing issue that requires authentication and local presence to exploit.

Frequently asked questions