CVE-2026-44501: CWE-502: Deserialization of Untrusted Data in datahub-project datahub
DataHub is an open-source metadata platform. Prior to 1.5.0.3, The DataHub frontend (datahub-frontend-react) deserializes attacker-controlled Java objects from the REDIRECT_URL HTTP cookie during the OIDC callback flow, with no integrity protection (no HMAC, no encryption). This is a Deserialization of Untrusted Data vulnerability (CWE-502) affecting the GET /callback/oidc endpoint. Successful exploitation requires a valid user account in the configured OIDC identity provider This vulnerability is fixed in 1.5.0.3.
AI Analysis
Technical Summary
DataHub's frontend (datahub-frontend-react) prior to version 1.5.0.3 improperly deserializes untrusted Java objects from the REDIRECT_URL HTTP cookie during the OIDC callback endpoint (/callback/oidc). This deserialization occurs without any integrity checks such as HMAC or encryption, leading to a CWE-502 vulnerability. Successful exploitation requires that the attacker has a valid user account in the configured OIDC identity provider. The vulnerability is resolved in DataHub version 1.5.0.3.
Potential Impact
An attacker with a valid user account in the OIDC identity provider can supply malicious serialized Java objects via the REDIRECT_URL cookie, potentially causing unsafe deserialization in the frontend. The CVSS vector indicates network attack vector, low attack complexity, required privileges, no user interaction, and limited confidentiality impact. There is no impact on integrity or availability reported. No known exploits in the wild have been documented.
Mitigation Recommendations
Upgrade DataHub to version 1.5.0.3 or later, where this vulnerability is fixed. Since no official patch links or vendor advisory are provided, confirm the upgrade path from the DataHub project releases. No temporary or alternative mitigations are indicated. Patch status is confirmed by the description stating the issue is fixed in 1.5.0.3.
CVE-2026-44501: CWE-502: Deserialization of Untrusted Data in datahub-project datahub
Description
DataHub is an open-source metadata platform. Prior to 1.5.0.3, The DataHub frontend (datahub-frontend-react) deserializes attacker-controlled Java objects from the REDIRECT_URL HTTP cookie during the OIDC callback flow, with no integrity protection (no HMAC, no encryption). This is a Deserialization of Untrusted Data vulnerability (CWE-502) affecting the GET /callback/oidc endpoint. Successful exploitation requires a valid user account in the configured OIDC identity provider This vulnerability is fixed in 1.5.0.3.
CVSS v3.1
Score 4.3medium
Affected software
pkg:github/datahub-project/datahubRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
DataHub's frontend (datahub-frontend-react) prior to version 1.5.0.3 improperly deserializes untrusted Java objects from the REDIRECT_URL HTTP cookie during the OIDC callback endpoint (/callback/oidc). This deserialization occurs without any integrity checks such as HMAC or encryption, leading to a CWE-502 vulnerability. Successful exploitation requires that the attacker has a valid user account in the configured OIDC identity provider. The vulnerability is resolved in DataHub version 1.5.0.3.
Potential Impact
An attacker with a valid user account in the OIDC identity provider can supply malicious serialized Java objects via the REDIRECT_URL cookie, potentially causing unsafe deserialization in the frontend. The CVSS vector indicates network attack vector, low attack complexity, required privileges, no user interaction, and limited confidentiality impact. There is no impact on integrity or availability reported. No known exploits in the wild have been documented.
Mitigation Recommendations
Upgrade DataHub to version 1.5.0.3 or later, where this vulnerability is fixed. Since no official patch links or vendor advisory are provided, confirm the upgrade path from the DataHub project releases. No temporary or alternative mitigations are indicated. Patch status is confirmed by the description stating the issue is fixed in 1.5.0.3.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-06T18:28:20.886Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a05f312ec166c07b0f45c9c
Added to database: 05/14/2026, 16:06:42 UTC
Last enriched: 05/14/2026, 16:22:00 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 103
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.