Home

Description

A security vulnerability has been detected in wandb 0.25.2.dev1. Affected is the function ArtifactManifestEntry.download in the library wandb/sdk/lib/hashutil.py of the component Artifact Integrity Validation. The manipulation leads to use of weak hash. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The pull request to fix this issue awaits acceptance.

PUBLISHED Reserved 2026-07-13 | Published 2026-07-13 | Updated 2026-07-13 | Assigner VulDB




LOW: 2.3CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X
LOW: 3.1CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R
LOW: 3.1CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R
2.1AV:N/AC:H/Au:S/C:P/I:N/A:N/E:ND/RL:ND/RC:UR

Problem types

Use of Weak Hash

Risky Cryptographic Algorithm

Timeline

2026-07-13:Advisory disclosed
2026-07-13:VulDB entry created
2026-07-13:VulDB entry last update

Credits

Dem0000000 (VulDB User) reporter

VulDB CNA Team coordinator

References

vuldb.com/vuln/378114 (VDB-378114 | wandb Artifact Integrity Validation hashutil.py ArtifactManifestEntry.download weak hash) vdb-entry technical-description

vuldb.com/vuln/378114/cti (VDB-378114 | CTI Indicators (IOB, IOC, TTP, IOA)) signature permissions-required

vuldb.com/cve/CVE-2026-15605 (CVE-2026-15605 | CVE Analysis and Report) third-party-advisory

vuldb.com/submit/855675 (Submit #855675 | Weights & Biases wandb 0.25.2.dev1 at commit 28cc0bf5a9b529b72e5e501d0a48c6c42220ae0a; earlier versions may be affected if they use the same MD5-based CWE-328 Use of Weak Hash) third-party-advisory

github.com/wandb/wandb/issues/12030 issue-tracking

github.com/wandb/wandb/pull/12031 issue-tracking patch

github.com/wandb/wandb/ product

cve.org (CVE-2026-15605)

nvd.nist.gov (CVE-2026-15605)

Download JSON