https://shellvoide.com/blog/blog The Shellvoide security blog: AI-driven penetration testing, vulnerability research, and application security insights from the team behind KLUE. en-us info@shellvoide.com (Shellvoide) info@shellvoide.com (Shellvoide) Wed, 07 Oct 2026 00:00:00 GMT https://shellvoide.com/blog/blog/hydra-untrusted-config-rce https://shellvoide.com/blog/blog/hydra-untrusted-config-rce Hydra is the configuration framework a large part of the Python machine-learning world uses to wire up experiments and apps. We pointed KLUE, our AI security agent, at it, and it found two ways to run code on a machine that loads an untrusted Hydra config. Both get around the blocklist Hydra had already added to stop exactly this. One slips through gaps in that blocklist; the other goes through the logging system, a door the blocklist never guarded. Both were reported, accepted, assigned CVEs (CVE-2026-106441 and CVE-2026-106442), rated High, and fixed. Wed, 07 Oct 2026 00:00:00 GMT info@shellvoide.com (Shellvoide) kluecase-studyvulnerability-researchcode-executioncode-injectiondeserializationpicklepythonmachine-learninghydraconfig-securityautonomous-securityappsec