Arbitrary Module Import Vulnerability in Hydra Ray Launcher by Hydra Ecosystem

CVE-2026-115749

What is CVE-2026-115749?

Hydra Ray Launcher versions 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 are susceptible to an arbitrary module import vulnerability. This occurs due to the ray_pkg_version OmegaConf resolver that controls input passed to importlib.import_module(). Malicious users can exploit this flaw by manipulating configuration values or command-line arguments, allowing them to import installed modules and execute their respective import-time side effects within the application process.

References