Skip to content

DataHub OIDC REDIRECT_URL Cookie Deserialization Vulnerability

Moderate
RyanHolstien published GHSA-rjf9-p49v-42c4 Apr 30, 2026

Package

datahub-frontend

Affected versions

1.5.0.2<=

Patched versions

>=1.5.0.3

Description

Impact

The DataHub frontend (datahub-frontend-react) deserializes attacker-controlled Java objects from the REDIRECT_URL HTTP cookie during the OIDC callback flow, with no integrity protection (no HMAC, no encryption). This is a Deserialization of Untrusted Data vulnerability (CWE-502) affecting the GET /callback/oidc endpoint.
Successful exploitation requires a valid user account in the configured OIDC identity provider — no DataHub application-level roles or privileges are needed. OIDC/SSO must be enabled, which is a standard production configuration. At minimum, an authenticated attacker can achieve blind SSRF, allowing them to send requests to internal hosts and perform internal port scanning. RCE may be possible depending on available gadget chains, though none were confirmed at time of disclosure.

Patches

The fix will be available in the next available release after 1.5.0.2

References

CWE-502: Deserialization of Untrusted Data

Credit

Brett Gervasoni

Severity

Moderate

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CVE ID

CVE-2026-44501

Weaknesses

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. Learn more on MITRE.

Credits