Read the docs
TI-2023-10861 Aliases CVE-2023-25558

Deserialization of untrusted data in DataHub

Priority MEDIUM 42CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-502.

Summary

DataHub is an open-source metadata platform. When the DataHub frontend is configured to authenticate via SSO, it will leverage the pac4j library. The processing of the `id_token` is done in an unsafe manner which is not properly accounted for by the DataHub frontend. Specifically, if any of the id_token claims value start with the {#sb64} prefix, pac4j considers the value to be a serialized Java object and will deserialize it. This issue may lead to Remote Code Execution (RCE) in the worst case. Although a `RestrictedObjectInputStream` is in place, that puts some restriction on what classes can be deserialized, it still allows a broad range of java packages and potentially exploitable with different gadget chains. Users are advised to upgrade. There are no known workarounds. This vulnerability was discovered and reported by the GitHub Security lab and is tracked as GHSL-2022-086.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01034 64th percentileScored 2026-11-07
Fix Fixed datahub (datahub-project): 0.9.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
datahub-projectdatahubbefore 0.9.50.9.5Patch availableCNA
  • datahub Vendordatahub-project Affected before 0.9.5 Fixed in 0.9.5 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:datahub_project:datahub:*:*:*:*:*:*:*:*before 0.9.5Vulnerabledatahub-project
  • cpe:2.3:a:datahub_project:datahub:*:*:*:*:*:*:*:* Versions before 0.9.5 Vulnerable ·datahub-project

Remediation

  • Fix · CNA datahub (datahub-project) Fixed in 0.9.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-25558

References

Patch 1

Advisory 1

  • TI-2024-14983 Default Privileges allow for high level operations for low privileged users in datahub CVSS 3.1HIGH 8.8
  • TI-2023-25771 Privilege escalation through email sign-up in datahub CVSS 3.1HIGH 8.0
  • TI-2023-25770 Session Expiration Misconfiguration in datahub CVSS 3.1MEDIUM 4.8
  • TI-2023-25780 Insecure Use of HMAC-SHA1 For Session Signing in datahub CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences