CVE-2026-10800: PaddlePaddle FastDeploy Weak Hash Vulnerability

Technical summary

The vulnerability exists in fastdeploy/multimodal/hasher.py, specifically in the hash_features function of the MultimodalHasher component. The weakness allows use of insufficient hash algorithms (CWE-327) and weak cryptographic mechanisms (CWE-328) that do not provide adequate collision resistance or preimage resistance. An attacker must have local system access and user-level permissions to trigger the vulnerability. The high attack complexity indicates that exploitation requires detailed understanding of the hashing implementation and careful manipulation of input conditions. The patch identified as 374945747652a8d32965591c0c01a00c88b7067f addresses the underlying cryptographic deficiency.

Business impact

The business impact is limited due to the requirement for local access and elevated complexity. However, in environments where untrusted users share compute resources—such as shared ML training clusters or containerized deployment platforms—a malicious local user could compromise the integrity of multimodal feature hashes. This could enable hash collisions leading to incorrect feature matching in ML pipelines, potentially corrupting model outputs or enabling data poisoning attacks on training workflows. Organizations running FastDeploy in multi-tenant environments should prioritize remediation over those using it in isolated, single-tenant deployments.

Affected systems

PaddlePaddle FastDeploy up to and including version 2.4.1 is affected. The vulnerability is specific to the MultimodalHasher component, so only deployments using multimodal feature hashing are at risk. Users of FastDeploy for other purposes (computer vision, NLP without multimodal features) should verify whether their installation includes or depends on the affected component.

Exploitability

The CVSS 3.1 score of 3.6 (LOW severity) reflects limited exploitability. Exploitation requires: (1) local system access, (2) user-level privileges or higher, (3) high technical complexity to craft inputs that meaningfully manipulate hash output, and (4) knowledge of the hashing algorithm implementation details. The vulnerability is not remotely exploitable and does not appear on CISA's Known Exploited Vulnerabilities catalog, indicating no active weaponized exploitation in the wild. However, once the patch is public, motivated attackers in multi-tenant environments may develop practical exploits.

Remediation

Apply the available patch (commit 374945747652a8d32965591c0c01a00c88b7067f or verify the corresponding release version against the official PaddlePaddle FastDeploy repository). If immediate patching is not feasible, restrict local system access to trusted users only, implement kernel-level access controls to prevent local privilege escalation, and consider deploying FastDeploy in isolated, single-tenant containers or VMs where multi-user scenarios are eliminated.

Patch guidance

Obtain the patch from the official PaddlePaddle FastDeploy GitHub repository or release channel. Verify that the patch commit (374945747652a8d32965591c0c01a00c88b7067f) is present in your deployed version. Test the patched version in a non-production environment to confirm that multimodal hashing functionality remains correct and that no regressions are introduced. Update deployment documentation to reflect the new version, and communicate the patch to all teams running FastDeploy.

Detection guidance

Monitor for local user accounts accessing fastdeploy/multimodal/hasher.py or calling hash_features with unusual or repeated inputs. Log attempts to load or inspect hash implementations at runtime. Verify the integrity of the hasher.py file by comparing its checksum against the official release. Implement file-access controls to alert on modifications to the multimodal hashing component. For ML pipeline monitoring, watch for unexpected hash collisions or mismatches in downstream feature matching that might indicate hash manipulation.

Why prioritize this

This vulnerability should be addressed during normal patching cycles but does not require emergency remediation unless your organization operates a multi-tenant ML platform or shared FastDeploy infrastructure. The combination of local-access requirement, user-privilege requirement, high attack complexity, and lack of known exploits means the real-world risk in most single-tenant or air-gapped deployments is minimal. Prioritize it below remote code execution and authentication bypass vulnerabilities, but include it in your standard quarterly or bimonthly patch windows.

Risk score, explained

The CVSS 3.1 score of 3.6 reflects a low-severity vulnerability because: (1) Attack Vector is Local (AV:L)—no remote exploitation possible; (2) Attack Complexity is High (AC:H)—requires significant technical effort and deep knowledge; (3) Privileges Required is Low (PR:L)—only user-level access, not root; (4) Integrity and Availability impacts are Low (I:L, A:L)—hash manipulation causes limited harm compared to confidentiality breaches or data destruction. The vulnerability presents a secondary or tertiary risk in most threat models unless hash integrity is critical to your ML pipelines.

Frequently asked questions