CVE Feed

    Dashboard / CVE / CVE-2026-44501

    CVE-2026-44501

    DataHub is an open-source metadata platform. Prior to 1.5.0.3, The DataHub frontend (datahub-frontend-react) deserializes attacker-controlled Java objects from the REDIRECT_URL HTTP cookie during the OIDC callback flow, with no integrity protection (no HMAC, no encryption). This is a Deserialization of Untrusted Data vulnerability (CWE-502) affecting the GET /callback/oidc endpoint. Successful exploitation requires a valid user account in the configured OIDC identity provider This vulnerability is fixed in 1.5.0.3.

    Published:May 14, 2026
    Last Modified:May 16, 2026
    EPS:May 14, 2026
    EPSS Score:0.00021
    CVSS Score:4.3

    Affected Products

    Vendor
    Datahub
    Product
    Datahub
    Vendor
    Datahub Project
    Product
    Datahub

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-586 Object Injection

    Related CVEs

    CVE-2026-50775 (CVSS 9.8) — A blind SSRF attack in DataHub v.1.5.0.1 allows a remote attacker to execute arbitrary code via the server ret…
    CVE-2026-25644 (CVSS 7.5) — DataHub is an open-source metadata platform. Prior to version 1.3.1.8, the LDAP ingestion source is vulnerable…
    CVE-2023-25557 (CVSS 7.5) — DataHub is an open-source metadata platform. The DataHub frontend acts as a proxy able to forward any REST or …
    CVE-2023-25559 (CVSS 8.2) — DataHub is an open-source metadata platform. When not using authentication for the metadata service, which is …
    CVE-2023-25560 (CVSS 8.2) — DataHub is an open-source metadata platform. The AuthServiceClient which is responsible for creation of new ac…
    CVE-2023-25561 (CVSS 5.7) — DataHub is an open-source metadata platform. In the event a system is using Java Authentication and Authorizat…
    CVE-2023-25562 (CVSS 6.9) — DataHub is an open-source metadata platform. In versions of DataHub prior to 0.8.45 Session cookies are only c…
    CVE-2022-39366 (CVSS 9.9) — DataHub is an open-source metadata platform. Prior to version 0.8.45, the `StatelessTokenService` of the DataH…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High