CVE-2026-44501

· MEDIUMAnalyzed

← All CVEs

CVSS v3.1

4.3

EPSS

0.14%

Published

May 14, 2026

Modified

May 16, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

DataHub is an open-source metadata platform. Prior to 1.5.0.3, The DataHub frontend (datahub-frontend-react) deserializes attacker-controlled Java objects from the REDIRECT_URL HTTP cookie during the OIDC callback flow, with no integrity protection (no HMAC, no encryption). This is a Deserialization of Untrusted Data vulnerability (CWE-502) affecting the GET /callback/oidc endpoint. Successful exploitation requires a valid user account in the configured OIDC identity provider This vulnerability is fixed in 1.5.0.3.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-502

Affected Products (1)

datahub · datahub (up to 1.5.0.3)vulnerable

References (1)

https://github.com/datahub-project/datahub/security/advisories/GHSA-rjf9-p49v-42c4

Vendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs