CVE-2026-15605 PUBLISHED

A security vulnerability has been detected in wandb 0.25.2.dev1. Affected is the function ArtifactManifestEntry.download in the library wandb/sdk/lib/hashutil.py of the component Artifact Integrity Validation. The manipulation leads to use of weak hash. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The pull request to fix this issue awaits acceptance.

• Dem0000000 (VulDB User) reporter
• VulDB CNA Team coordinator

• VDB-378114 | wandb Artifact Integrity Validation hashutil.py ArtifactManifestEntry.download weak hash
• VDB-378114 | CTI Indicators (IOB, IOC, TTP, IOA)
• CVE-2026-15605 | CVE Analysis and Report
• Submit #855675 | Weights & Biases wandb 0.25.2.dev1 at commit 28cc0bf5a9b529b72e5e501d0a48c6c42220ae0a; earlier versions may be affected if they use the same MD5-based CWE-328 Use of Weak Hash
• https://github.com/wandb/wandb/issues/12030
• https://github.com/wandb/wandb/pull/12031
• https://github.com/wandb/wandb/

• Use of Weak Hash CWE
• Risky Cryptographic Algorithm CWE