CVE-2026-25644: DataHub's LDAP Ingestion Source vulnerable to MITM attack through TLS downgrade
Published Feb 6, 2026
·Updated
DataHub is an open-source metadata platform. Prior to version 1.3.1.8, the LDAP ingestion source is vulnerable to MITM attack through TLS downgrade. This issue has been patched in version 1.3.1.8.
Affected Software
2 affected components
DataHub<1.3.1.8
datahub DataHub<1.3.1.8
Event History
Feb 6, 2026
CVE Published
via MITRE·10:40 PM
Data Sourced
via MITRE·10:40 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:15 PM
DescriptionSeverityWeaknessAffected Software
May 15, 58112
Event
via FIRST·06:57 PM
Frequently Asked Questions
1
What is the severity of CVE-2026-25644?
CVE-2026-25644 is classified as a high-severity vulnerability due to the potential for a man-in-the-middle attack.
2
How do I fix CVE-2026-25644?
To fix CVE-2026-25644, upgrade DataHub to version 1.3.1.8 or later.
3
What is the impact of CVE-2026-25644?
CVE-2026-25644 allows attackers to perform man-in-the-middle attacks by exploiting a TLS downgrade vulnerability in the LDAP ingestion source.
4
In which versions of DataHub does CVE-2026-25644 affect?
CVE-2026-25644 affects all versions of DataHub prior to 1.3.1.8.
5
Is CVE-2026-25644 a local or remote vulnerability?
CVE-2026-25644 is a remote vulnerability since it can be exploited by an attacker within network proximity to intercept LDAP traffic.