CVE-2026-68508: Hydra: hydra.utils.instantiate with untrusted config can lead to code execution

hydra.utils.instantiate() resolves and calls Python objects from config. If an application passes untrusted config to instantiate(), an attacker who controls _target_ and its arguments can cause arbitrary code execution in the consuming process.

Hydra is not a network service. Exploitation requires a consuming application, library, or user workflow to load attacker-controlled config, CLI overrides, or model metadata and pass it to hydra.utils.instantiate().