CVE-2026-7018

A vulnerability was determined in Datavane Datavines up to 13607645e14a4982468cfdbcf75c85cde63bae71. The affected element is an unknown function of the file datavines-core/src/main/java/io/datavines/core/utils/TokenManager.java of the component JWT Token Handler. Executing a manipulation of the argument tokenSecret can lead to use of hard-coded cryptographic key . The attack can be executed remotely. The attack requires a high level of complexity. The exploitability is described as difficult. The exploit has been publicly disclosed and may be utilized. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. This patch is called e540d6dc04e2e6ad11907fb655f3728a13e7b939. It is advisable to implement a patch to correct this issue. The project was informed of the problem early through a pull request but has not reacted yet.

• CWE-320
• CWE-321

• https://github.com/datavane/datavines/
• https://github.com/datavane/datavines/issues/580
• https://github.com/datavane/datavines/issues/580#issue-4206839649
• https://github.com/datavane/datavines/pull/579
• https://github.com/datavane/datavines/pull/579/changes/e540d6dc04e2e6ad11907fb655f3728a13e7b939
• https://vuldb.com/submit/797305
• https://vuldb.com/vuln/359597
• https://vuldb.com/vuln/359597/cti

Published

Apr 26, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7014A flaw has been found in MaxSite CMS up to 109.3. This vulne…2.4
• CVE-2026-70145Out-of-bounds read in Microsoft Windows Search Component all…5.5
• CVE-2026-7015A vulnerability has been found in MaxSite CMS up to 109.3. T…2.4
• CVE-2026-7016A vulnerability was found in MaxSite CMS up to 109.3. Impact…2.4
• CVE-2026-7017HTTP::Tiny versions before 0.095 for Perl forward credential…7.1
• CVE-2026-70178Missing authorization in Microsoft Fabric allows an authoriz…8.8
• CVE-2026-7019A vulnerability was identified in Tenda F456 1.0.0.5. The im…8.8
• CVE-2026-7020A security flaw has been discovered in Ollama up to 0.20.2. …3.7
• CVE-2026-70200Improper limitation of a pathname to a restricted directory …9.8
• CVE-2026-70203Heap-based buffer overflow in Windows Media Player allows an…8.8
• CVE-2026-7021A weakness has been identified in SmythOS sre up to 0.0.15. …3.5
• CVE-2026-7022A security vulnerability has been detected in SmythOS sre up…7.3