CVE-2026-10766: mlrun Weak Hash Vulnerability

CVE-2026-10766 Overview

CVE-2026-10766 is a weak cryptographic hash vulnerability affecting mlrun up to version 1.12.0-rc3. The flaw resides in the calculate_dataframe_hash function in mlrun/utils/helpers.py, part of the DataFrame Hash Handler component. The function uses a weak hash algorithm [CWE-327], which can compromise data integrity assumptions made by downstream consumers of the hash value.

The attack requires local access and has high complexity, making exploitation difficult. The issue has been publicly disclosed, and a pull request to address it is pending acceptance by the upstream project.

Critical Impact
Weak hash usage in mlrun's DataFrame integrity check can allow an attacker with local access to produce colliding hashes, undermining data verification workflows in machine learning pipelines.

Affected Products

mlrun versions up to and including 1.12.0-rc3
Component: mlrun.utils.helpers.calculate_dataframe_hash
File: mlrun/utils/helpers.py (DataFrame Hash Handler)

Discovery Timeline

2026-06-03 - CVE-2026-10766 published to NVD
2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-10766

Vulnerability Analysis

The calculate_dataframe_hash function in mlrun generates a hash representation of a DataFrame for use in caching, integrity verification, and artifact tracking within ML pipelines. The function relies on a cryptographically weak hash algorithm, which produces digests vulnerable to collision attacks.

When a hash collision can be produced, an attacker can substitute a malicious or modified DataFrame while preserving the original digest. Pipelines that trust the hash as proof of integrity may then accept tampered data without raising errors.

Exploitation is limited to local environments and is rated as having high attack complexity, meaning a successful attack requires specific conditions and existing low-privilege access.

Root Cause

The root cause is the use of a hash algorithm not suitable for security-sensitive integrity verification. CWE-327 categorizes this as the use of a broken or risky cryptographic algorithm. Modern best practice requires SHA-256 or stronger for any integrity check whose output influences trust decisions.

Attack Vector

An attacker requires local access and low privileges on the system running mlrun. The attacker crafts a second DataFrame that hashes to the same value as a trusted one, then introduces it into a workflow that uses the hash as an authenticity signal. Confidentiality is not directly impacted; the consequences fall on integrity and availability of downstream pipeline steps.

No verified exploit code is publicly available. Technical context is available in the GitHub issue #9691 and the proposed fix in pull request #9692.

Detection Methods for CVE-2026-10766

Indicators of Compromise

Unexpected DataFrame content associated with a previously cached hash value in mlrun artifact stores.
Pipeline runs that complete successfully despite upstream data files showing modified timestamps or sizes.
Multiple distinct DataFrame artifacts sharing identical calculate_dataframe_hash output.

Detection Strategies

Inspect mlrun deployments for use of the calculate_dataframe_hash function and audit downstream consumers that rely on its output for trust decisions.
Compare DataFrame hashes generated by calculate_dataframe_hash against a parallel SHA-256 digest of the same content to identify integrity drift.
Review source control history for changes to mlrun/utils/helpers.py and confirm the patched version is in use.

Monitoring Recommendations

Log all DataFrame artifact registrations and hash values in the mlrun project database for retrospective collision analysis.
Alert on file modifications to mlrun/utils/helpers.py on production ML infrastructure.
Track local account activity on hosts running mlrun, since exploitation requires local low-privilege access.

How to Mitigate CVE-2026-10766

Immediate Actions Required

Inventory all mlrun installations and identify versions at or below 1.12.0-rc3.
Restrict local access to mlrun runtime hosts to authorized users only, since the attack vector is local.
Treat outputs of calculate_dataframe_hash as advisory rather than authoritative until the patch is applied.

Patch Information

The fix is proposed in pull request #9692 against the mlrun repository and awaits acceptance. Track the GitHub issue #9691 for status updates and apply the upstream release once it is published. Additional details are catalogued at VulDB CVE-2026-10766.

Workarounds

Replace calls to calculate_dataframe_hash in custom code with a SHA-256-based equivalent computed over a deterministic DataFrame serialization.
Add an independent integrity check, such as a digital signature over the DataFrame, alongside the existing hash.
Limit who can write to mlrun artifact storage to reduce the chance of substituting colliding DataFrames.

bash

# Configuration example: compute a stronger hash alongside mlrun's built-in hash
python - <<'EOF'
import hashlib
import pandas as pd

def strong_dataframe_hash(df: pd.DataFrame) -> str:
    payload = df.to_csv(index=False).encode("utf-8")
    return hashlib.sha256(payload).hexdigest()

# Use strong_dataframe_hash() as the authoritative integrity value
# until mlrun PR #9692 is merged and deployed.
EOF