DataHub Frontend React CVE-2026-44501

Exploitation requires the following specific conditions: (1) The DataHub deployment must be configured with OIDC as the authentication mechanism; (2) The attacker must possess a valid user account in the configured OIDC identity provider and complete OIDC authentication; (3) The attacker must intercept or control the REDIRECT_URL cookie during the callback flow (via network access to inject the cookie or by compromising the user's browser/session); (4) The DataHub frontend classpath must include gadget libraries that can be chained for exploitation (this depends on the specific versions of dependencies bundled with DataHub). Non-OIDC deployments using other authentication methods are not affected. The vulnerability is limited to confidentiality impact per CVSS, suggesting that remote code execution may not be possible or is severely constrained.

CVSS 4.3 with network vector and low complexity indicates this is a moderately severe vulnerability, but the requirement for PR:L (authenticated user) and C:L (low confidentiality impact) significantly constrains real-world risk. The attacker must already possess a valid OIDC identity provider account, reducing the threat surface to authenticated users or insiders. EPSS and active exploitation data are not provided, so widespread automation is not confirmed. The absence from CISA KEV and lack of public POC further suggest this is not currently a high-priority target. However, Java deserialization vulnerabilities are well-understood attack vectors with mature tooling (e.g., ysoserial), so the actual risk depends on available gadget chains in DataHub's classpath. The low confidentiality-only impact contrasts with typical deserialization severity; verify whether the actual impact scope is limited to information disclosure or if remote code execution is possible given the gadget libraries present.

An attacker with a valid account in the configured OIDC identity provider crafts a malicious serialized Java object and injects it into the REDIRECT_URL cookie during the OIDC callback. When the DataHub frontend deserializes the cookie, the malicious object triggers a gadget chain, allowing the attacker to read sensitive metadata or configuration information accessible to the frontend process. The attack requires the attacker to first authenticate with the OIDC provider, then manipulate the callback request.