CVE-2026-44501 Details
Description
DataHub is an open-source metadata platform. Prior to 1.5.0.3, The DataHub frontend (datahub-frontend-react) deserializes attacker-controlled Java objects from the REDIRECT_URL HTTP cookie during the OIDC callback flow, with no integrity protection (no HMAC, no encryption). This is a Deserialization of Untrusted Data vulnerability (CWE-502) affecting the GET /callback/oidc endpoint. Successful exploitation requires a valid user account in the configured OIDC identity provider This vulnerability is fixed in 1.5.0.3.
A deserialization vulnerability has been identified in the DataHub frontend component (datahub-frontend-react) versions 1.5.0.2 and prior. This vulnerability occurs in the OpenID Connect (OIDC) callback flow, specifically at the GET /callback/oidc endpoint. The issue arises because the application deserializes Java objects from the REDIRECT_URL HTTP cookie, which can be controlled by an attacker. Notably, this deserialization process lacks integrity protection, such as HMAC or encryption. Exploitation of this vulnerability requires a valid user account with the OIDC identity provider, as OIDC/SSO must be enabled—a standard configuration in production environments. At a minimum, an authenticated attacker could exploit this vulnerability to perform blind Server-Side Request Forgery (SSRF), allowing them to send requests to internal hosts and conduct port scanning. Depending on the availability of certain gadget chains, remote code execution (RCE) might also be achievable, although no such exploitation was confirmed at the time of disclosure.
Users can upgrade to DataHub version 1.5.0.3 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/datahub-project/datahub/security/advisories/GHSA-rjf9-p49v-42c4 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| datahub datahub | < 1.5.0.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 16, 2026 | Initial Analysis | [email protected] |
| May 14, 2026 | New CVE Received | [email protected] |