CVE-2026-15605: wandb Artifact Integrity Validation hashutil.py ArtifactManifestEntry.download weak hash

Severity: low (CVSS 3.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-13 · updated 2026-07-14
Weakness: CWE-327

Description

A security vulnerability has been detected in wandb 0.25.2.dev1. Affected is the function ArtifactManifestEntry.download in the library wandb/sdk/lib/hashutil.py of the component Artifact Integrity Validation. The manipulation leads to use of weak hash. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The pull request to fix this issue awaits acceptance.

Affected products

wandb: 0.25.2.dev1

References

https://github.com/wandb/wandb/
https://github.com/wandb/wandb/issues/12030
https://github.com/wandb/wandb/pull/12031
https://vuldb.com/cve/CVE-2026-15605
https://vuldb.com/submit/855675
https://vuldb.com/vuln/378114
https://vuldb.com/vuln/378114/cti

Get alerted when CVE-2026-15605 or the next vulnerability affects your stack