CVE-2026-106442: Hydra instantiate target blacklist bypasses permit code execution

Hydra’s instantiate() API resolves and invokes Python callables named by the _target_ field in configuration. The target blacklist introduced for CVE-2026-68508 was incomplete.

Representative bypasses included execution wrappers such as timeit.timeit, executable deserialization through pickle.loads, and generic dispatch or wrapper targets that obscured the effective callable. Target aliases, callable-returning helpers, and deferred dispatch could similarly bypass name-based checks.

An attacker who can cause an application to instantiate an untrusted Hydra configuration can use these gaps to execute code with the application’s privileges.