CVE-2024-29037

datahub-helm provides the Kubernetes Helm charts for deploying Datahub and its dependencies on a Kubernetes cluster. Starting in version 0.1.143 and prior to version 0.2.182, due to configuration issues in the helm chart, if there was a successful initial deployment during a limited window of time, personal access tokens were possibly created with a default secret key. Since the secret key is a static, publicly available value, someone could inspect the algorithm used to generate personal access tokens and generate their own for an instance. Deploying with Metadata Service Authentication enabled would have been difficult during window of releases. If someone circumvented the helm settings and manually set Metadata Service Authentication to be enabled using environment variables directly, this would skip over the autogeneration logic for the Kubernetes Secrets and DataHub GMS would default to the signing key specified statically in the application.yml. Most deployments probably did not attempt to circumvent the helm settings to enable Metadata Service Authentication during this time, so impact is most likely limited. Any deployments with Metadata Service Authentication enabled should ensure that their secret values are properly randomized. Version 0.2.182 contains a patch for this issue. As a workaround, one may reset the token signing key to be a random value, which will invalidate active personal access tokens.

• CWE-1394

• https://github.com/acryldata/datahub-helm/commit/ea8a17860f053c63387b8309e1f77c0e1462a1b3Issue Tracking, Release Notes
• https://github.com/acryldata/datahub-helm/security/advisories/GHSA-82p6-9h7m-9h8jVendor Advisory
• https://github.com/acryldata/datahub-helm/commit/ea8a17860f053c63387b8309e1f77c0e1462a1b3Issue Tracking, Release Notes
• https://github.com/acryldata/datahub-helm/security/advisories/GHSA-82p6-9h7m-9h8jVendor Advisory

Published

Mar 20, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-29031Meshery is an open source, cloud native manager that enables…7.5
• CVE-2024-29032Qiskit IBM Runtime is an environment that streamlines quantu…7.8
• CVE-2024-29033OAuthenticator provides plugins for JupyterHub to use common…9.1
• CVE-2024-29034CarrierWave is a solution for file uploads for Rails, Sinatr…6.1
• CVE-2024-29035Umbraco is an ASP.NET CMS. Failing webhooks logs are availab…5.3
• CVE-2024-29036Saleor Storefront is software for building e-commerce experi…6.5
• CVE-2024-29038tpm2-tools is the source repository for the Trusted Platform…3.3
• CVE-2024-29039tpm2 is the source repository for the Trusted Platform Modul…8.1
• CVE-2024-2904Cross-Site Request Forgery (CSRF) vulnerability in Extend Th…8.8
• CVE-2024-29040This repository hosts source code implementing the Trusted C…4.3
• CVE-2024-29041Express.js minimalist web framework for node. Versions of Ex…6.1
• CVE-2024-29042Translate is a package that allows users to convert text to …5.3