Datahub-project vulnerabilities
We track 12 vulnerabilities in Datahub-project products. 12 are rated high or critical, and none are known to be exploited. The most recent was published on May 14, 2026.
Latest Datahub-project vulnerabilities
- 7.1 High severity
datahub: Deserialization of Untrusted Data
DataHub is an open-source metadata platform. Prior to 1.5.0.3, The DataHub frontend (datahub-frontend-react) deserializes attacker-controlled Java objects from the REDIRECT_URL HTTP cookie during the OIDC callback flow, with no integrity protection (no HMAC, n
- 7.5 High severity
datahub: Improper Certificate Validation
DataHub is an open-source metadata platform. Prior to version 1.3.1.8, the LDAP ingestion source is vulnerable to MITM attack through TLS downgrade. This issue has been patched in version 1.3.1.8.
- 8.8 High severity
datahub: Incorrect Default Permissions
DataHub is an open-source metadata platform. In affected versions a low privileged user could remove a user, edit group members, or edit another user's profile information. The default privileges gave too many broad permissions to low privileged users. These h
- 8.8 High severity
datahub: Use of a Broken or Risky Cryptographic Algorithm
DataHub is an open-source metadata platform. The HMAC signature for DataHub Frontend sessions was being signed using a SHA-1 HMAC with the frontend secret key. SHA1 with a 10 byte key can be brute forced using sufficient resources (i.e. state level actors with
- 8.0 High severity
datahub: Improper Privilege Management
DataHub is an open-source metadata platform. In affected versions sign-up through an invite link does not properly restrict users from signing up as privileged accounts. If a user is given an email sign-up link they can potentially create an admin account give
- 9.8 Critical severity
DataHub is an open-source metadata platform.
DataHub is an open-source metadata platform. In versions of DataHub prior to 0.8.45 Session cookies are only cleared on new sign-in events and not on logout events. Any authentication checks using the `AuthUtils.hasValidSessionCookie()` method could be bypasse
- 9.8 Critical severity
datahub: Improper Handling of Exceptional Conditions
DataHub is an open-source metadata platform. In the event a system is using Java Authentication and Authorization Service (JAAS) authentication and that system is given a configuration which contains an error, the authentication for the system will fail open a
- 9.8 Critical severity
datahub: Improper Control of Dynamically-Managed Code Resources
DataHub is an open-source metadata platform. The AuthServiceClient which is responsible for creation of new accounts, verifying credentials, resetting them or requesting access tokens, crafts multiple JSON strings using format strings with user-controlled data
- 8.1 High severity
datahub: Incorrect Authorization
DataHub is an open-source metadata platform. When not using authentication for the metadata service, which is the default configuration, the Metadata service (GMS) will use the X-DataHub-Actor HTTP header to infer the user the frontend is sending the request o
- 8.8 High severity
datahub: Deserialization of Untrusted Data
DataHub is an open-source metadata platform. When the DataHub frontend is configured to authenticate via SSO, it will leverage the pac4j library. The processing of the `id_token` is done in an unsafe manner which is not properly accounted for by the DataHub fr
- 9.1 Critical severity
datahub: Server-Side Request Forgery
DataHub is an open-source metadata platform. The DataHub frontend acts as a proxy able to forward any REST or GraphQL requests to the backend. The goal of this proxy is to perform authentication if needed and forward HTTP requests to the DataHub Metadata Store
- 9.8 Critical severity
datahub: Improper Verification of Cryptographic Signature
DataHub is an open-source metadata platform. Prior to version 0.8.45, the `StatelessTokenService` of the DataHub metadata service (GMS) does not verify the signature of JWT tokens. This allows an attacker to connect to DataHub instances as any user if Metadata