CVE-2026-7018 Details
Description
A vulnerability was determined in Datavane Datavines up to 13607645e14a4982468cfdbcf75c85cde63bae71. The affected element is an unknown function of the file datavines-core/src/main/java/io/datavines/core/utils/TokenManager.java of the component JWT Token Handler. Executing a manipulation of the argument tokenSecret can lead to use of hard-coded cryptographic key . The attack can be executed remotely. The attack requires a high level of complexity. The exploitability is described as difficult. The exploit has been publicly disclosed and may be utilized. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. This patch is called e540d6dc04e2e6ad11907fb655f3728a13e7b939. It is advisable to implement a patch to correct this issue. The project was informed of the problem early through a pull request but has not reacted yet.
A critical JWT authentication bypass vulnerability exists in Datavane Datavines versions prior to the latest commit 13607645e14a4982468cfdbcf75c85cde63bae71. The issue arises from a hardcoded JWT secret in the TokenManager class, which is not configurable through the application's YAML file. This flaw allows all default deployments to use the same secret, 'asdqwe'. Additionally, the AuthenticationInterceptor class contains a self-comparison logic flaw, where the token's password is validated against itself rather than the actual user record, enabling an attacker to forge a valid JWT token and bypass authentication entirely.
Users are advised to update to the latest version of Datavane Datavines, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 26, 2026CISA-ADP
Assessed Apr 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/datavane/datavines/ | [email protected] | Vendor |
| https://github.com/datavane/datavines/issues/580 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/datavane/datavines/issues/580#issue-4206839649 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/datavane/datavines/pull/579 | [email protected] | Issue TrackingVendor |
| https://github.com/datavane/datavines/pull/579/changes/e540d6dc04e2e6ad11907fb655f3728a13e7b939 | [email protected] | Source CodeVendor |
| https://vuldb.com/submit/797305 | [email protected] | Technical Description |
| https://vuldb.com/vuln/359597 | [email protected] | AdvisoryBundleExploitRemedy |
| https://vuldb.com/vuln/359597/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-320 | Key Management Errors | [email protected] |
| CWE-321 | Use of Hard-coded Cryptographic Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Datavane Datavines | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Apr 26, 2026 | New CVE Received | [email protected] |