{"id":"PYSEC-2026-3487","summary":"mlrun: DataFrame hash collisions can cause dataset artifact path conflicts and silent data corruption","details":"A vulnerability has been found in mlrun up to 1.12.0-rc3. This impacts the function mlrun.utils.helpers.calculate_dataframe_hash of the file mlrun/utils/helpers.py of the component DataFrame Hash Handler. The manipulation leads to use of weak hash. The attack can only be performed from a local environment. The complexity of an attack is rather high. The exploitability is said to be difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.","aliases":["CVE-2026-10766","GHSA-phx2-3w66-h4pw"],"modified":"2026-07-23T15:00:15.476005511Z","published":"2026-07-23T11:41:37.839535Z","references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10766"},{"type":"WEB","url":"https://github.com/mlrun/mlrun/issues/9691"},{"type":"WEB","url":"https://github.com/mlrun/mlrun/pull/9692"},{"type":"PACKAGE","url":"https://github.com/mlrun/mlrun"},{"type":"WEB","url":"https://vuldb.com/cve/CVE-2026-10766"},{"type":"WEB","url":"https://vuldb.com/submit/831419"},{"type":"WEB","url":"https://vuldb.com/vuln/368136"},{"type":"WEB","url":"https://vuldb.com/vuln/368136/cti"},{"type":"PACKAGE","url":"https://pypi.org/project/mlrun"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-phx2-3w66-h4pw"}],"affected":[{"package":{"name":"mlrun","ecosystem":"PyPI","purl":"pkg:pypi/mlrun"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.12.0rc3"}]}],"versions":["0.1.6","0.10.0","0.10.0rc1","0.10.0rc2","0.10.0rc3","0.10.0rc4","0.10.0rc5","0.10.0rc6","0.10.0rc7","0.10.0rc8","0.10.0rc9","0.10.1","0.10.1rc1","0.10.1rc2","0.10.1rc3","0.10.1rc4","0.10.1rc5","0.10.1rc6","0.10.1rc7","0.10.1rc8","0.10.1rc9","0.10.2rc1","0.2.0","0.2.5","0.3.0","0.3.1","0.3.2","0.3.3","0.4.1","0.4.10","0.4.3","0.4.4","0.4.5","0.4.6","0.4.7","0.4.8","0.4.9","0.5.0","0.5.1","0.5.1rc1","0.5.1rc2","0.5.2","0.5.2rc1","0.5.2rc2","0.5.3","0.5.3rc1","0.5.3rc2","0.5.3rc3","0.5.4","0.5.4rc1","0.5.5","0.5.5rc1","0.5.5rc2","0.5.5rc3","0.5.5rc4","0.5.5rc5","0.5.5rc6","0.5.6","0.5.6rc1","0.5.6rc2","0.5.6rc3","0.6.0","0.6.0rc1","0.6.0rc10","0.6.0rc11","0.6.0rc12","0.6.0rc13","0.6.0rc2","0.6.0rc3","0.6.0rc4","0.6.0rc5","0.6.0rc6","0.6.0rc7","0.6.0rc8","0.6.0rc9","0.6.1","0.6.1rc1","0.6.1rc2","0.6.1rc3","0.6.1rc4","0.6.2","0.6.2rc1","0.6.2rc10","0.6.2rc11","0.6.2rc2","0.6.2rc3","0.6.2rc4","0.6.2rc5","0.6.2rc6","0.6.2rc7","0.6.2rc8","0.6.2rc9","0.6.3","0.6.3rc1","0.6.3rc10","0.6.3rc11","0.6.3rc12","0.6.3rc2","0.6.3rc3","0.6.3rc4","0.6.3rc5","0.6.3rc6","0.6.3rc7","0.6.3rc8","0.6.3rc9","0.6.4","0.6.4rc1","0.6.4rc10","0.6.4rc11","0.6.4rc12","0.6.4rc13","0.6.4rc2","0.6.4rc3","0.6.4rc4","0.6.4rc5","0.6.4rc6","0.6.4rc7","0.6.4rc8","0.6.4rc9","0.6.5","0.6.5rc1","0.6.5rc10","0.6.5rc11","0.6.5rc12","0.6.5rc13","0.6.5rc14","0.6.5rc15","0.6.5rc16","0.6.5rc17","0.6.5rc18","0.6.5rc19","0.6.5rc2","0.6.5rc3","0.6.5rc4","0.6.5rc5","0.6.5rc6","0.6.5rc7","0.6.5rc8","0.6.5rc9","0.6.6","0.6.6rc1","0.6.6rc2","0.7.0","0.7.0rc1","0.7.0rc10","0.7.0rc11","0.7.0rc12","0.7.0rc13","0.7.0rc14","0.7.0rc15","0.7.0rc16","0.7.0rc17","0.7.0rc2","0.7.0rc3","0.7.0rc4","0.7.0rc5","0.7.0rc6","0.7.0rc7","0.7.0rc8","0.7.0rc9","0.7.1","0.7.1rc1","0.7.2rc1","0.8.0","0.8.0rc1","0.8.0rc10","0.8.0rc11","0.8.0rc12","0.8.0rc13","0.8.0rc14","0.8.0rc15","0.8.0rc2","0.8.0rc3","0.8.0rc4","0.8.0rc5","0.8.0rc6","0.8.0rc7","0.8.0rc8","0.8.0rc9","0.9.0","0.9.0rc1","0.9.0rc10","0.9.0rc11","0.9.0rc12","0.9.0rc13","0.9.0rc2","0.9.0rc3","0.9.0rc4","0.9.0rc5","0.9.0rc6","0.9.0rc7","0.9.0rc8","0.9.0rc9","0.9.1","0.9.1rc1","0.9.2","0.9.2rc1","0.9.3","0.9.3rc1","1.0.0","1.0.0rc1","1.0.0rc10","1.0.0rc11","1.0.0rc12","1.0.0rc13","1.0.0rc14","1.0.0rc15","1.0.0rc16","1.0.0rc17","1.0.0rc18","1.0.0rc19","1.0.0rc2","1.0.0rc20","1.0.0rc21","1.0.0rc22","1.0.0rc23","1.0.0rc24","1.0.0rc25","1.0.0rc26","1.0.0rc3","1.0.0rc4","1.0.0rc5","1.0.0rc6","1.0.0rc7","1.0.0rc8","1.0.0rc9","1.0.1","1.0.2","1.0.2rc1","1.0.2rc2","1.0.2rc4","1.0.3","1.0.3rc1","1.0.3rc2","1.0.4","1.0.4rc1","1.0.4rc2","1.0.4rc3","1.0.5","1.0.5rc1","1.0.5rc10","1.0.5rc11","1.0.5rc12","1.0.5rc13","1.0.5rc14","1.0.5rc2","1.0.5rc3","1.0.5rc4","1.0.5rc5","1.0.5rc6","1.0.5rc7","1.0.5rc8","1.0.5rc9","1.0.6","1.0.6rc1","1.1.0","1.1.0rc1","1.1.0rc10","1.1.0rc11","1.1.0rc12","1.1.0rc13","1.1.0rc14","1.1.0rc15","1.1.0rc16","1.1.0rc17","1.1.0rc18","1.1.0rc19","1.1.0rc2","1.1.0rc20","1.1.0rc21","1.1.0rc22","1.1.0rc23","1.1.0rc24","1.1.0rc25","1.1.0rc26","1.1.0rc27","1.1.0rc28","1.1.0rc29","1.1.0rc3","1.1.0rc30","1.1.0rc31","1.1.0rc32","1.1.0rc33","1.1.0rc4","1.1.0rc5","1.1.0rc6","1.1.0rc7","1.1.0rc8","1.1.0rc9","1.1.1","1.1.1rc1","1.1.1rc10","1.1.1rc2","1.1.1rc3","1.1.1rc4","1.1.1rc5","1.1.1rc6","1.1.1rc7","1.1.1rc8","1.1.1rc9","1.1.2","1.1.2rc1","1.1.2rc2","1.1.2rc3","1.1.3","1.1.3rc1","1.1.3rc2","1.1.3rc3","1.1.3rc4","1.10.0","1.10.0rc1","1.10.0rc10","1.10.0rc11","1.10.0rc12","1.10.0rc13","1.10.0rc14","1.10.0rc15","1.10.0rc16","1.10.0rc17","1.10.0rc18","1.10.0rc19","1.10.0rc2","1.10.0rc20","1.10.0rc21","1.10.0rc22","1.10.0rc23","1.10.0rc24","1.10.0rc25","1.10.0rc26","1.10.0rc27","1.10.0rc28","1.10.0rc29","1.10.0rc3","1.10.0rc30","1.10.0rc31","1.10.0rc32","1.10.0rc33","1.10.0rc34","1.10.0rc35","1.10.0rc36","1.10.0rc37","1.10.0rc38","1.10.0rc39","1.10.0rc4","1.10.0rc40","1.10.0rc41","1.10.0rc42","1.10.0rc43","1.10.0rc44","1.10.0rc5","1.10.0rc6","1.10.0rc7","1.10.0rc8","1.10.0rc9","1.10.1","1.10.1rc1","1.10.1rc10","1.10.1rc11","1.10.1rc3","1.10.1rc4","1.10.1rc5","1.10.1rc6","1.10.1rc7","1.10.1rc8","1.10.1rc9","1.10.2","1.10.2rc3","1.10.3","1.10.4rc1","1.11.0","1.11.0rc1","1.11.0rc12","1.11.0rc13","1.11.0rc14","1.11.0rc15","1.11.0rc16","1.11.0rc17","1.11.0rc18","1.11.0rc19","1.11.0rc2","1.11.0rc20","1.11.0rc21","1.11.0rc22","1.11.0rc24","1.11.0rc25","1.11.0rc26","1.11.0rc27","1.11.0rc28","1.11.0rc29","1.11.0rc3","1.11.0rc30","1.11.0rc31","1.11.0rc32","1.11.0rc33","1.11.0rc34","1.11.0rc35","1.11.0rc36","1.11.0rc37","1.11.0rc38","1.11.0rc39","1.11.0rc4","1.11.0rc40","1.11.0rc41","1.11.0rc42","1.11.0rc44","1.11.0rc46","1.11.0rc47","1.11.0rc48","1.11.0rc5","1.11.0rc6","1.11.0rc7","1.11.0rc8","1.11.0rc9","1.12.0rc1","1.12.0rc2","1.12.0rc3","1.2.0","1.2.0rc1","1.2.0rc10","1.2.0rc11","1.2.0rc12","1.2.0rc13","1.2.0rc14","1.2.0rc15","1.2.0rc16","1.2.0rc17","1.2.0rc18","1.2.0rc19","1.2.0rc2","1.2.0rc20","1.2.0rc21","1.2.0rc22","1.2.0rc3","1.2.0rc4","1.2.0rc5","1.2.0rc6","1.2.0rc7","1.2.0rc8","1.2.0rc9","1.2.1","1.2.1rc1","1.2.1rc10","1.2.1rc11","1.2.1rc12","1.2.1rc2","1.2.1rc3","1.2.1rc4","1.2.1rc5","1.2.1rc6","1.2.1rc7","1.2.1rc8","1.2.1rc9","1.2.2","1.2.2rc1","1.2.3","1.2.3rc1","1.2.3rc2","1.2.3rc3","1.3.0","1.3.0rc1","1.3.0rc10","1.3.0rc11","1.3.0rc12","1.3.0rc13","1.3.0rc14","1.3.0rc15","1.3.0rc16","1.3.0rc17","1.3.0rc18","1.3.0rc19","1.3.0rc2","1.3.0rc20","1.3.0rc21","1.3.0rc22","1.3.0rc23","1.3.0rc24","1.3.0rc25","1.3.0rc26","1.3.0rc27","1.3.0rc28","1.3.0rc29","1.3.0rc3","1.3.0rc30","1.3.0rc31","1.3.0rc32","1.3.0rc33","1.3.0rc34","1.3.0rc35","1.3.0rc36","1.3.0rc37","1.3.0rc38","1.3.0rc39","1.3.0rc4","1.3.0rc40","1.3.0rc5","1.3.0rc6","1.3.0rc7","1.3.0rc8","1.3.0rc9","1.3.1","1.3.1rc1","1.3.1rc10","1.3.1rc2","1.3.1rc3","1.3.1rc4","1.3.1rc5","1.3.1rc6","1.3.1rc7","1.3.1rc8","1.3.1rc9","1.3.2","1.3.2rc1","1.3.2rc2","1.3.2rc3","1.3.2rc4","1.3.2rc5","1.3.3","1.3.3rc1","1.3.4","1.3.4rc1","1.4.0","1.4.0rc1","1.4.0rc10","1.4.0rc11","1.4.0rc12","1.4.0rc13","1.4.0rc14","1.4.0rc15","1.4.0rc16","1.4.0rc17","1.4.0rc18","1.4.0rc19","1.4.0rc2","1.4.0rc20","1.4.0rc21","1.4.0rc22","1.4.0rc23","1.4.0rc24","1.4.0rc25","1.4.0rc3","1.4.0rc4","1.4.0rc5","1.4.0rc6","1.4.0rc7","1.4.0rc8","1.4.0rc9","1.4.1","1.4.1rc1","1.5.0","1.5.0rc1","1.5.0rc10","1.5.0rc11","1.5.0rc12","1.5.0rc13","1.5.0rc14","1.5.0rc15","1.5.0rc16","1.5.0rc17","1.5.0rc18","1.5.0rc19","1.5.0rc2","1.5.0rc20","1.5.0rc21","1.5.0rc22","1.5.0rc23","1.5.0rc3","1.5.0rc4","1.5.0rc5","1.5.0rc6","1.5.0rc7","1.5.0rc8","1.5.0rc9","1.5.1","1.5.1rc1","1.5.1rc2","1.5.1rc3","1.5.2","1.5.2rc1","1.5.2rc2","1.5.2rc3","1.6.0","1.6.0rc1","1.6.0rc10","1.6.0rc11","1.6.0rc12","1.6.0rc13","1.6.0rc14","1.6.0rc15","1.6.0rc16","1.6.0rc17","1.6.0rc18","1.6.0rc19","1.6.0rc2","1.6.0rc20","1.6.0rc21","1.6.0rc22","1.6.0rc23","1.6.0rc24","1.6.0rc25","1.6.0rc26","1.6.0rc27","1.6.0rc28","1.6.0rc29","1.6.0rc3","1.6.0rc30","1.6.0rc31","1.6.0rc32","1.6.0rc33","1.6.0rc34","1.6.0rc35","1.6.0rc4","1.6.0rc5","1.6.0rc6","1.6.0rc7","1.6.0rc8","1.6.0rc9","1.6.1","1.6.1rc1","1.6.2","1.6.2rc1","1.6.2rc2","1.6.2rc3","1.6.2rc4","1.6.2rc5","1.6.2rc6","1.6.3","1.6.3rc1","1.6.3rc10","1.6.3rc11","1.6.3rc12","1.6.3rc13","1.6.3rc14","1.6.3rc2","1.6.3rc3","1.6.3rc4","1.6.3rc5","1.6.3rc6","1.6.3rc7","1.6.3rc8","1.6.3rc9","1.6.4","1.6.4rc1","1.6.4rc2","1.6.4rc3","1.6.4rc4","1.6.4rc5","1.6.4rc6","1.6.4rc7","1.6.4rc8","1.7.0","1.7.0rc1","1.7.0rc11","1.7.0rc12","1.7.0rc13","1.7.0rc14","1.7.0rc15","1.7.0rc16","1.7.0rc17","1.7.0rc18","1.7.0rc19","1.7.0rc2","1.7.0rc20","1.7.0rc21","1.7.0rc22","1.7.0rc23","1.7.0rc24","1.7.0rc25","1.7.0rc26","1.7.0rc27","1.7.0rc28","1.7.0rc29","1.7.0rc3","1.7.0rc30","1.7.0rc31","1.7.0rc32","1.7.0rc33","1.7.0rc34","1.7.0rc35","1.7.0rc36","1.7.0rc37","1.7.0rc38","1.7.0rc39","1.7.0rc4","1.7.0rc40","1.7.0rc41","1.7.0rc42","1.7.0rc43","1.7.0rc44","1.7.0rc45","1.7.0rc46","1.7.0rc47","1.7.0rc48","1.7.0rc49","1.7.0rc5","1.7.0rc50","1.7.0rc51","1.7.0rc52","1.7.0rc53","1.7.0rc54","1.7.0rc55","1.7.0rc56","1.7.0rc57","1.7.0rc58","1.7.0rc6","1.7.0rc7","1.7.0rc8","1.7.0rc9","1.7.1","1.7.1rc1","1.7.1rc10","1.7.1rc2","1.7.1rc3","1.7.1rc4","1.7.1rc5","1.7.1rc6","1.7.1rc7","1.7.1rc8","1.7.1rc9","1.7.2","1.7.2rc1","1.7.2rc2","1.7.2rc3","1.7.2rc4","1.8.0","1.8.0rc1","1.8.0rc10","1.8.0rc11","1.8.0rc12","1.8.0rc13","1.8.0rc15","1.8.0rc16","1.8.0rc17","1.8.0rc18","1.8.0rc19","1.8.0rc2","1.8.0rc20","1.8.0rc21","1.8.0rc22","1.8.0rc24","1.8.0rc25","1.8.0rc26","1.8.0rc27","1.8.0rc28","1.8.0rc29","1.8.0rc3","1.8.0rc30","1.8.0rc31","1.8.0rc32","1.8.0rc33","1.8.0rc34","1.8.0rc35","1.8.0rc36","1.8.0rc37","1.8.0rc38","1.8.0rc39","1.8.0rc4","1.8.0rc40","1.8.0rc41","1.8.0rc42","1.8.0rc43","1.8.0rc44","1.8.0rc45","1.8.0rc46","1.8.0rc47","1.8.0rc48","1.8.0rc49","1.8.0rc5","1.8.0rc50","1.8.0rc51","1.8.0rc52","1.8.0rc53","1.8.0rc54","1.8.0rc55","1.8.0rc56","1.8.0rc57","1.8.0rc58","1.8.0rc59","1.8.0rc6","1.8.0rc60","1.8.0rc61","1.8.0rc62","1.8.0rc7","1.8.0rc8","1.8.0rc9","1.9.0","1.9.0rc1","1.9.0rc10","1.9.0rc11","1.9.0rc12","1.9.0rc13","1.9.0rc2","1.9.0rc3","1.9.0rc4","1.9.0rc5","1.9.0rc6","1.9.0rc7","1.9.0rc8","1.9.0rc9","1.9.1","1.9.1rc1","1.9.2","1.9.2rc1","1.9.2rc2","1.9.2rc3"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/mlrun/PYSEC-2026-3487.yaml"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}]}