CVE-2026-10804

Katalog CVE

CVSS 4.7 · Medium EPSS 0,08%

Kerentanan Use of a Broken or Risky Cryptographic Algorithm pada snowflake streamlit. Skor CVSS 3.1 4.7 (Medium) menurut NVD.

Deskripsi (NVD)

A vulnerability has been found in Streamlit up to 1.53.0. Impacted is an unknown function in the library lib/streamlit/runtime/caching/hashing.py of the component Palette Handler. Such manipulation leads to use of weak hash. Local access is required to approach this attack. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.

Rincian

Terbit di NVD

4 Juni 2026

Terakhir diubah

22 Juli 2026

Status NVD

Analyzed

CVSS 3.1

4.7 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-327: Use of a Broken or Risky Cryptographic Algorithm
CWE-328: Use of Weak Hash

EPSS (30 hari)

0,08% peluang dieksploitasi; lebih tinggi dari 0,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/streamlit/streamlit/issues/14622 issue tracking · mitigasi · patch
• https://github.com/streamlit/streamlit/pull/14635 issue tracking · patch
• https://vuldb.com/cve/CVE-2026-10804 advisory pihak ketiga · vdb entry
• https://vuldb.com/submit/831508 advisory pihak ketiga · vdb entry
• https://vuldb.com/vuln/368253 advisory pihak ketiga · vdb entry
• https://github.com/streamlit/streamlit/ product
• https://vuldb.com/vuln/368253/cti permissions required · vdb entry