All vulnerabilities
CVE-2022-39366GHSA-r8gm-v65f-c973PYSEC-2026-252

acryl-datahub missing JWT signature check

datahub-project acryl-datahubpipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
9.9Critical
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 22 Apr 2025. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)1.11%Chance of exploitation activity in the next 30 days, higher than 65% of CVEs. Scored 26 Oct 2026FIRST EPSS
Fixed in0.8.45Fixed versionGitHub
Published28 Oct 2022Updated 26 Oct 2026CVE List

What fixes it

  • 0.8.45acryl-datahub, pipGitHub
  • 0.8.45acryl-datahub, PyPIOSVpip install "acryl-datahub>=0.8.45"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Missing JWT signature check (GHSL-2022-078)

The [StatelessTokenService](https://github.com/datahub-project/datahub/blob/aa146db611e3a4ca3aa17bb740783f789d4444d3/metadata-service/auth-impl/src/main/java/com/datahub/authentication/token/StatelessTokenService.java#L30) of the DataHub metadata service (GMS) does not verify the signature of JWT tokens. This allows an attacker to connect to DataHub instances as any user if Metadata Service authentication is enabled. This vulnerability occurs because the StatelessTokenService of the Metadata service uses the [parse](https://github.com/datahub-project/datahub/blob/aa146db611e3a4ca3aa17bb740783f789d4444d3/metadata-service/auth-impl/src/main/java/com/datahub/authentication/token/StatelessTokenService.java#L134) method of io.jsonwebtoken.JwtParser, which does not perform a verification of the cryptographic token signature. This means that JWTs are accepted regardless of the used algorithm.

Impact

This issue may lead to an authentication bypass.

Resources

Text from GitHub Advisory Database

Affected versions 53

  • acryl-datahub, pip< 0.8.45GitHub
  • datahubaffected: < 0.8.45CVE List
  • acryl-datahub, PyPIfrom first release, fixed in 0.8.45OSV
  • acryl-datahub, PyPI0.0.2OSV
  • acryl-datahub, PyPI0.0.3OSV
  • acryl-datahub, PyPI0.0.4OSV
  • acryl-datahub, PyPI0.0.5OSV
  • acryl-datahub, PyPI0.1.0OSV
  • acryl-datahub, PyPI0.1.1OSV
  • acryl-datahub, PyPI0.1.2OSV
  • acryl-datahub, PyPI0.1.3OSV
  • acryl-datahub, PyPI0.2.0OSV
  • acryl-datahub, PyPI0.2.1OSV
  • acryl-datahub, PyPI0.2.2OSV
  • acryl-datahub, PyPI0.2.3OSV
  • acryl-datahub, PyPI0.3.0OSV
  • acryl-datahub, PyPI0.3.1OSV
  • acryl-datahub, PyPI0.3.2OSV
  • acryl-datahub, PyPI0.3.3OSV
  • acryl-datahub, PyPI0.3.4OSV
  • acryl-datahub, PyPI0.4.0OSV
  • acryl-datahub, PyPI0.8.1.0OSV
  • acryl-datahub, PyPI0.8.1.1OSV
  • acryl-datahub, PyPI0.8.1.2OSV
  • acryl-datahub, PyPI0.8.10.0OSV
  • acryl-datahub, PyPI0.8.10.1OSV
  • acryl-datahub, PyPI0.8.10.2OSV
  • acryl-datahub, PyPI0.8.11.0OSV
  • acryl-datahub, PyPI0.8.11.1OSV
  • acryl-datahub, PyPI0.8.12.0OSV
  • acryl-datahub, PyPI0.8.13.0OSV
  • acryl-datahub, PyPI0.8.13.1OSV
  • acryl-datahub, PyPI0.8.14.0OSV
  • acryl-datahub, PyPI0.8.14.1OSV
  • acryl-datahub, PyPI0.8.14.2OSV
  • acryl-datahub, PyPI0.8.15.0OSV
  • acryl-datahub, PyPI0.8.15.1OSV
  • acryl-datahub, PyPI0.8.15.10OSV
  • acryl-datahub, PyPI0.8.15.2OSV
  • acryl-datahub, PyPI0.8.15.3OSV
  • acryl-datahub, PyPI0.8.15.4OSV
  • acryl-datahub, PyPI0.8.15.5OSV
  • acryl-datahub, PyPI0.8.15.6OSV
  • acryl-datahub, PyPI0.8.15.7OSV
  • acryl-datahub, PyPI0.8.15.8OSV
  • acryl-datahub, PyPI0.8.15.9OSV
  • acryl-datahub, PyPI0.8.16.0OSV
  • acryl-datahub, PyPI0.8.16.1OSV
  • acryl-datahub, PyPI0.8.16.11OSV
  • acryl-datahub, PyPI0.8.16.12OSV
  • acryl-datahub, PyPI0.8.16.2OSV
  • acryl-datahub, PyPI0.8.16.3OSV
  • acryl-datahub, PyPI0.8.16.4OSV

References 10