CVE-2026-44501: DataHub OIDC REDIRECT_URL Cookie Deserialization Vulnerability
DataHub is an open-source metadata platform. Prior to 1.5.0.3, The DataHub frontend (datahub-frontend-react) deserializes attacker-controlled Java objects from the REDIRECTURL HTTP cookie during the OIDC callback flow, with no integrity protection (no HMAC, no encryption). This is a Deserialization of Untrusted Data vulnerability (CWE-502) affecting the GET /callback/oidc endpoint. Successful exploitation requires a valid user account in the configured OIDC identity provider This vulnerability is fixed in 1.5.0.3.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44501?
CVE-2026-44501 has a medium severity level due to its potential to enable remote code execution through deserialized attacker-controlled Java objects.
How do I fix CVE-2026-44501?
To fix CVE-2026-44501, upgrade DataHub to version 1.5.0.3 or later.
What is the impact of CVE-2026-44501?
The impact of CVE-2026-44501 is that it allows an attacker to execute arbitrary code on the server through malicious REDIRECT_URL cookies.
Which products are affected by CVE-2026-44501?
CVE-2026-44501 affects the DataHub frontend, specifically the datahub-frontend-react version prior to 1.5.0.3.
Is CVE-2026-44501 easy to exploit?
Yes, CVE-2026-44501 can be easy to exploit as it relies on deserialization of attacker-controlled data without integrity checks.