CVE-2026-25644
📋 TL;DR
DataHub's LDAP ingestion source is vulnerable to TLS downgrade attacks, allowing man-in-the-middle attackers to intercept and potentially modify LDAP authentication traffic. This affects all DataHub deployments using LDAP authentication with versions prior to 1.3.1.8.
💻 Affected Systems
- DataHub
📦 What is this software?
Datahub by Datahub
⚠️ Risk & Real-World Impact
Worst Case
Attackers intercept LDAP credentials, gain unauthorized access to DataHub, and potentially compromise sensitive metadata or pivot to other systems using stolen credentials.
Likely Case
Credential theft leading to unauthorized access to DataHub's metadata platform and potential data exfiltration.
If Mitigated
Limited impact if LDAP traffic is already protected by network segmentation or if alternative authentication methods are used.
🎯 Exploit Status
Requires MITM position on network path between DataHub and LDAP server. Attack leverages TLS downgrade to force plaintext LDAP communication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.3.1.8
Vendor Advisory: https://github.com/datahub-project/datahub/security/advisories/GHSA-j34h-x7qg-4qw5
Restart Required: Yes
Instructions:
1. Backup your DataHub configuration and data. 2. Upgrade DataHub to version 1.3.1.8 or later. 3. Restart all DataHub services. 4. Verify LDAP authentication is working correctly.
🔧 Temporary Workarounds
Disable LDAP authentication
allTemporarily disable LDAP authentication and use alternative authentication methods until patching is possible.
Modify DataHub configuration to remove LDAP authentication source
Network segmentation
allIsolate DataHub and LDAP server communication to trusted network segments only.
🧯 If You Can't Patch
- Implement network-level TLS termination or VPN between DataHub and LDAP server
- Monitor network traffic for unexpected TLS downgrade attempts or plaintext LDAP communication
🔍 How to Verify
Check if Vulnerable:
Check DataHub version: if version < 1.3.1.8 and LDAP authentication is configured, system is vulnerable.Check Version:
Check DataHub deployment configuration or run: kubectl get pods -n datahub -o jsonpath='{.items[*].spec.containers[*].image}' (for Kubernetes deployments)Verify Fix Applied:
Confirm DataHub version is 1.3.1.8 or later and test LDAP authentication functionality.📡 Detection & Monitoring
Log Indicators:
- Failed LDAP authentication attempts
- Unexpected authentication source changes
Network Indicators:
- Plaintext LDAP traffic on port 389 when TLS was expected
- TLS downgrade attempts
SIEM Query:
source="network_traffic" AND (protocol="ldap" AND NOT tls_version OR tls_version="NULL") AND (src_ip="datahub_server" OR dst_ip="ldap_server")