CVE-2026-15605: wandb Weak Hash RCE Vulnerability

CVE-2026-15605 Overview

CVE-2026-15605 is a weak cryptographic hash vulnerability in the Weights & Biases (wandb) machine learning experiment tracking library, version 0.25.2.dev1. The flaw resides in the ArtifactManifestEntry.download function within wandb/sdk/lib/hashutil.py, part of the Artifact Integrity Validation component. The implementation relies on a weak hash algorithm [CWE-327] to validate downloaded artifacts, undermining integrity guarantees for machine learning models, datasets, and experiment outputs. The issue can theoretically be triggered remotely, but exploitation requires high attack complexity and specific conditions. A pull request addressing the flaw is pending upstream acceptance.

Critical Impact
Attackers who can influence artifact storage or intercept transfers may substitute malicious artifacts that pass integrity checks, compromising ML pipeline outputs.

Affected Products

wandb 0.25.2.dev1 (Python SDK)
wandb/sdk/lib/hashutil.py module
Artifact Integrity Validation component (ArtifactManifestEntry.download)

Discovery Timeline

2026-07-13 - CVE-2026-15605 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-15605

Vulnerability Analysis

The vulnerability affects how wandb verifies the integrity of downloaded artifacts. The ArtifactManifestEntry.download function in hashutil.py uses a cryptographically weak hash algorithm to compare downloaded artifact content against expected manifest values. Weak hashes such as MD5 are susceptible to collision attacks, allowing distinct inputs to produce identical digests.

In ML workflows, artifacts include model weights, training datasets, and evaluation results. Integrity validation is the primary safeguard against tampered artifacts flowing into training and inference pipelines. When that validation depends on a collision-prone hash, an attacker who controls artifact storage or a proxy can craft a malicious payload that matches the recorded digest.

The vulnerability is classified under [CWE-327] Use of a Broken or Risky Cryptographic Algorithm. Exploitation is remote but requires high complexity, low privileges, and no user interaction.

Root Cause

The root cause is the selection of a weak hash function for security-relevant integrity verification inside hashutil.py. Cryptographic hashes used for integrity must be collision-resistant, and algorithms like MD5 no longer meet that bar. Reusing such algorithms for tamper detection creates a gap between perceived and actual assurance.

Attack Vector

An attacker with the ability to modify artifact content in transit or at rest, or to publish artifacts to a location wandb clients trust, can generate a payload whose weak-hash digest collides with a legitimate artifact. When a downstream user calls ArtifactManifestEntry.download, the malicious file passes validation and is loaded into the ML pipeline. The attack requires collision-generation capability and positioning within the artifact supply chain, which drives the high complexity rating.

No verified proof-of-concept code is available. See the GitHub pull request and the GitHub issue tracker entry for technical details on the proposed fix.

Detection Methods for CVE-2026-15605

Indicators of Compromise

Unexpected changes in artifact content while the recorded hash remains unchanged in the wandb manifest.
Artifact downloads originating from non-authoritative storage endpoints or unexpected S3/GCS buckets.
ML model outputs or evaluation metrics that deviate from historical baselines after artifact updates.

Detection Strategies

Inventory wandb SDK versions across data science and MLOps environments and flag hosts running 0.25.2.dev1.
Recompute strong hashes (SHA-256) over downloaded artifacts and compare against a trusted out-of-band record.
Monitor Python process telemetry for calls into wandb/sdk/lib/hashutil.py during artifact download operations.

Monitoring Recommendations

Log and alert on artifact retrievals from wandb clients, capturing source URL, size, and computed digests.
Track manifest modification events in wandb project histories for unexpected re-publishing of artifact versions.
Correlate ML pipeline anomalies with recent artifact downloads to identify potential tampering.

How to Mitigate CVE-2026-15605

Immediate Actions Required

Identify all systems using wandb 0.25.2.dev1 and restrict artifact downloads from untrusted sources until a patched release is available.
Enforce TLS for all wandb API and artifact storage endpoints to reduce in-transit tampering opportunities.
Re-verify critical artifacts using a strong hash such as SHA-256 maintained in an independent system of record.

Patch Information

A fix has been proposed via GitHub Pull Request #12031 but is pending acceptance at the time of publication. Track the GitHub issue #12030 and the wandb repository for the released version containing the fix, then upgrade all SDK installations.

Workarounds

Pin wandb to a version prior to the introduction of the weak-hash validation path where operationally feasible.
Wrap artifact download logic with an additional SHA-256 verification step comparing against a trusted manifest maintained outside wandb.
Restrict write access to artifact storage buckets so only vetted CI/CD identities can publish artifacts consumed by ML pipelines.

bash

# Configuration example: independent SHA-256 verification after wandb download
sha256sum ./artifacts/model.bin | awk '{print $1}' > computed.sha256
diff computed.sha256 trusted_manifest/model.sha256 || { echo "Integrity check failed"; exit 1; }