Read the docs
TI-2024-19219 Aliases CVE-2024-29037

Default secret use for initial deployment

Priority MEDIUM 48CWE-1394Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

datahub-helm provides the Kubernetes Helm charts for deploying Datahub and its dependencies on a Kubernetes cluster. Starting in version 0.1.143 and prior to version 0.2.182, due to configuration issues in the helm chart, if there was a successful initial deployment during a limited window of time, personal access tokens were possibly created with a default secret key. Since the secret key is a static, publicly available value, someone could inspect the algorithm used to generate personal access tokens and generate their own for an instance. Deploying with Metadata Service Authentication enabled would have been difficult during window of releases. If someone circumvented the helm settings and manually set Metadata Service Authentication to be enabled using environment variables directly, this would skip over the autogeneration logic for the Kubernetes Secrets and DataHub GMS would default to the signing key specified statically in the application.yml. Most deployments probably did not attempt to circumvent the helm settings to enable Metadata Service Authentication during this time, so impact is most likely limited. Any deployments with Metadata Service Authentication enabled should ensure that their secret values are properly randomized. Version 0.2.182 contains a patch for this issue. As a workaround, one may reset the token signing key to be a random value, which will invalidate active personal access tokens.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00605 49th percentileScored 2026-11-07
Fix Fixed datahub-helm (acryldata): 0.2.182

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
acryldatadatahub-helm0.1.143 to before 0.2.1820.2.182Patch availableCNA
  • datahub-helm Vendoracryldata Affected 0.1.143 to before 0.2.182 Fixed in 0.2.182 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:datahub:datahub-helm:*:*:*:*:*:*:*:*0.1.143 to before 0.2.182VulnerableDatahub
  • cpe:2.3:a:datahub:datahub-helm:*:*:*:*:*:*:*:* Versions 0.1.143 to before 0.2.182 Vulnerable ·Datahub

Remediation

  • Fix · CNA datahub-helm (acryldata) Fixed in 0.2.182

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-29037

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences