CVE-2026-10804

[CVE catalog]

Severity

Low · CVSS 3.6CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

Published

Jun 4, 2026, 12:00:14 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.08% · Oct 25, 2026

A flaw was found in Streamlit, within its Palette Handler component. This vulnerability stems from the use of a weak hashing algorithm. A local attacker could exploit this flaw, though it requires a high level of technical complexity. Successful exploitation may lead to a low impact on the integrity and availability of the affected system. streamlit: Streamlit: Weak hash usage leading to low integrity and availability impact Red Hat rates this vulnerability as Low impact with a CVSS score of 3.6, lower than NIST's 4.7. Red Hat products that ship Streamlit are limited to RHEL AI bootc containers and RHOAI's NeMo Guardrails server, where the caching functions are used for internal model serving rather than processing user-uploaded datasets, making the attack scenario unlikely. Red Hat scores integrity as Low rather than High because the hash collision requires preserving values at sampled positions, which constrains what the attacker can change. The attacker controls the non-sampled rows but cannot freely modify all cached data. Availability is Low because poisoned cache entries cause incorrect results for the cache lifetime without affecting the application itself. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.