AIKIDO-2026-90594

TL;DR

Hydra's _locate() dotted-path resolver performs a plain getattr attribute walk that can reach mutation methods such as .discard() on the module level policy sets (DEFAULT_BLOCKLISTED_MODULES, UNCONTROLLED_EXECUTION_TARGETS) backing the default instantiate() execution blocklist. A configuration with multiple sibling _target_ entries, processed in insertion order, can first resolve and call a removal method on the shared policy set and then instantiate the now unblocked target, bypassing the legacy blocklist path used when an application has not supplied its own execution whitelist. The fix moves target resolution off the raw mutable sets and hardens the discovery, dispatch, introspection, alias, callable-result, and deferred-callable paths so name only authorization can no longer be undermined this way.