Deserialization of Untrusted Data Vulnerability in DataHub by DataHub Project
CVE-2026-44501

4.3MEDIUM

Key Information:

Vendor

Datahub-project

Status
Datahub
Vendor
CVE Published:
14 May 2026

What is CVE-2026-44501?

DataHub, an open-source metadata platform, contains a vulnerability in its frontend (datahub-frontend-react) that allows attackers to deserialize untrusted Java objects from the REDIRECT_URL HTTP cookie during the OIDC callback process. This critical flaw, due to lack of integrity protection, exposes the system to potential exploits if attackers obtain valid user credentials from the configured OIDC identity provider. The issue has been addressed in version 1.5.0.3.

Affected Version(s)

datahub < 1.5.0.3

References

https://github.com/datahub-project/datahub/security/advis...
x_refsource_CONFIRM

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.