CVE-2026-44501

DataHub is an open-source metadata platform. Prior to 1.5.0.3, The DataHub frontend (datahub-frontend-react) deserializes attacker-controlled Java objects from the REDIRECT_URL HTTP cookie during the OIDC callback flow, with no integrity protection (no HMAC, no encryption). This is a Deserialization of Untrusted Data vulnerability (CWE-502) affecting the GET /callback/oidc endpoint. Successful exploitation requires a valid user account in the configured OIDC identity provider This vulnerability is fixed in 1.5.0.3.

• CWE-502

• https://github.com/datahub-project/datahub/security/advisories/GHSA-rjf9-p49v-42c4Vendor Advisory

Published

May 14, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44496Axios is a promise based HTTP client for the browser and Nod…7.5
• CVE-2026-44497ZEBRA is a Zcash node written entirely in Rust. Prior to zeb…9.1
• CVE-2026-44498ZEBRA is a Zcash node written entirely in Rust. Prior to ver…7.5
• CVE-2026-44499ZEBRA is a Zcash node written entirely in Rust. Prior to ver…8.7
• CVE-2026-4450Out of bounds write in V8 in Google Chrome prior to 146.0.76…8.8
• CVE-2026-44500ZEBRA is a Zcash node written entirely in Rust. Prior to zeb…5.3
• CVE-2026-44502Bugsink is a self-hosted error tracking tool. Prior to 2.1.3…4.3
• CVE-2026-44503The RedirectHandler middleware in microsoft/kiota-java (com.…7
• CVE-2026-44504Aegra is a drop-in replacement for LangSmith Deployments. Pr…8.6
• CVE-2026-44505Nimiq is a Rust implementation of the Nimiq Proof-of-Stake p…5.3
• CVE-2026-44507Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-44508Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…