What is the CVSS score of EUVD-2026-30321?

EUVD-2026-30321 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-30321?

Yes, a patch is available for EUVD-2026-30321. Update the affected software to the latest version immediately.

DataHub Frontend React EUVD-2026-30321

| CVE-2026-44501 MEDIUM

Deserialization of Untrusted Data (CWE-502)

2026-05-14 security-advisories@github.com

Java Deserialization

4.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

May 14, 2026 - 17:02 EUVD

Analysis Generated

May 14, 2026 - 16:30 vuln.today

CVE Published

May 14, 2026 - 16:16 nvd

MEDIUM 4.3

DescriptionGitHub Advisory

DataHub is an open-source metadata platform. Prior to 1.5.0.3, The DataHub frontend (datahub-frontend-react) deserializes attacker-controlled Java objects from the REDIRECT_URL HTTP cookie during the OIDC callback flow, with no integrity protection (no HMAC, no encryption). This is a Deserialization of Untrusted Data vulnerability (CWE-502) affecting the GET /callback/oidc endpoint. Successful exploitation requires a valid user account in the configured OIDC identity provider This vulnerability is fixed in 1.5.0.3.

AnalysisAI

DataHub frontend versions prior to 1.5.0.3 deserialize untrusted Java objects from the REDIRECT_URL HTTP cookie during OIDC callback flow without integrity protection, allowing authenticated attackers to read sensitive information. The vulnerability affects the GET /callback/oidc endpoint and requires a valid OIDC identity provider account to exploit. A vendor-released patch is available in version 1.5.0.3.

Technical ContextAI

DataHub is a metadata platform written in Java that uses OIDC (OpenID Connect) for authentication. During the OIDC callback flow, the frontend accepts a REDIRECT_URL parameter passed via HTTP cookie and deserializes it as a Java object without verifying HMAC, encryption, or other integrity controls. This classic Java deserialization vulnerability (CWE-502) enables gadget chain attacks where malicious serialized objects trigger arbitrary code execution or information disclosure when deserialized. The cookie-based transmission and OIDC integration path are specific to the datahub-frontend-react component.

RemediationAI

Upgrade DataHub to version 1.5.0.3 or later, which removes the unsafe deserialization of REDIRECT_URL. This is the primary and recommended fix. Until patching is possible, restrict access to the OIDC callback endpoint via a Web Application Firewall or reverse proxy to limit exposure to internal networks or trusted identity providers only. Additionally, audit OIDC identity provider configurations to ensure only authorized users have login rights, narrowing the attack surface to legitimate accounts. Verify that no untrusted gadget chain libraries are in the DataHub classpath (e.g., old versions of commons-beanutils, spring-core with unsafe features). Consult the GitHub security advisory GHSA-rjf9-p49v-42c4 for detailed upgrade instructions and rollback procedures.