CVE-2022-39366 DataHub missing JWT signature check
Attackers can bypass authentication and impersonate any user in DataHub if Metadata Service authentication is enabled, due to missing JWT signature verification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-39366?
CVE-2022-39366 is a critical authentication bypass vulnerability in datahub-project datahub, published on 28 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
DataHub is an open-source metadata platform. Prior to version 0.8.45, the `StatelessTokenService` of the DataHub metadata service (GMS) does not verify the signature of JWT tokens. This allows an attacker to connect to DataHub instances as any user if Metadata Service authentication is enabled. This vulnerability occurs because the `StatelessTokenService` of the Metadata service uses the `parse` method of `io.jsonwebtoken.JwtParser`, which does not perform a verification of the cryptographic token signature. This means that JWTs are accepted regardless of the used algorithm. This issue may lead to an authentication bypass. Version 0.8.45 contains a patch for the issue. There are no known workarounds.
Which versions are affected by CVE-2022-39366?
3 open source packages ship an affected version, including acryl-datahub. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
acryl-datahub PyPI | All versions | 0.8.45 |
acryl-datahub PyPI | All versions | 0.8.45 |
acryl-datahub PyPI | All versions | 0.8.45 |
Products include Datahub Datahub.
How do I fix CVE-2022-39366?
Upgrade acryl-datahub to 0.8.45 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2022-39366 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-39366 exists.
Other vulnerabilities in datahub-project datahub
- CVE-2023-25559 System account impersonation in DataHub
- CVE-2023-25560 JSON Injection in DataHub
- CVE-2026-25644 DataHub's LDAP Ingestion Source vulnerable to MITM attack through TLS downgrade
- CVE-2023-25557 Server-Side Request Forgery in DataHub
- CVE-2023-25562 Failure to Invalidate Session on Logout in DataHub
Sources
Also known as GHSA-r8gm-v65f-c973, PYSEC-2026-252.