CVE-2022-39366 — Vulnerability in acryl-datahub — CVE Details
CRITICAL
acryl-datahub missing JWT signature check
Published June 29, 2026Updated July 1, 2026Source: osv
Summary
# Missing JWT signature check (`GHSL-2022-078`)
The [`StatelessTokenService`](https://github.com/datahub-project/datahub/blob/aa146db611e3a4ca3aa17bb740783f789d4444d3/metadata-service/auth-impl/src/main/java/com/datahub/authentication/token/StatelessTokenService.java#L30) of the DataHub metadata service (GMS) does not verify the signature of JWT tokens. This allows an attacker to connect to DataHub instances as any user if Metadata Service authentication is enabled. This vulnerability occurs because the `StatelessTokenService` of the Metadata service uses the [`parse`](https://github.com/datahub-project/datahub/blob/aa146db611e3a4ca3aa17bb740783f789d4444d3/metadata-service/auth-impl/src/main/java/com/datahub/authentication/token/StatelessTokenService.java#L134) method of `io.jsonwebtoken.JwtParser`, which does not perform a verification of the cryptographic token signature. This means that JWTs are accepted regardless of the used algorithm.
#### Impact
This issue may lead to an authentication bypass.
#### Resources
* [CodeQL: Missing JWT signature check](https://codeql.github.com/codeql-query-help/java/java-missing-jwt-signature-check/)
Advisory Timeline
- First published June 29, 2026 (105 days ago).
- Last revised July 1, 2026 — 2 days after initial publication.
Remediation
Upgrade to the fixed version using your package manager.
pip
Update acryl-datahub to 0.8.45 or laterpip install "acryl-datahub>=0.8.45"
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (1)
Affects 1 ecosystem: pypi (1).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| acryl-datahub | pypi | 0.0.2, 0.0.3, 0.0.4, 0.0.5 (+317 more) | 0.8.45 |
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 9.9 score means for each attack dimension.
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
High
Availability
Low
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L
References
- https://github.com/datahub-project/datahub/security/advisories/GHSA-r8gm-v65f-c973WEB
- https://nvd.nist.gov/vuln/detail/CVE-2022-39366ADVISORY
- https://codeql.github.com/codeql-query-help/java/java-missing-jwt-signature-checkWEB
- https://github.com/datahub-project/datahubPACKAGE
- https://github.com/datahub-project/datahub/blob/aa146db611e3a4ca3aa17bb740783f789d4444d3/metadata-service/auth-impl/src/main/java/com/datahub/authentication/token/StatelessTokenService.java#L134WEB
- https://github.com/datahub-project/datahub/blob/aa146db611e3a4ca3aa17bb740783f789d4444d3/metadata-service/auth-impl/src/main/java/com/datahub/authentication/token/StatelessTokenService.java#L30WEB
- https://github.com/datahub-project/datahub/releases/tag/v0.8.45WEB
- https://pypi.org/project/acryl-datahubPACKAGE
- https://github.com/advisories/GHSA-r8gm-v65f-c973ADVISORY
Frequently Asked Questions
- What is CVE-2022-39366?
- acryl-datahub missing JWT signature check This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.9/10).
- How do I check if my project is affected by CVE-2022-39366?
- CVE-2022-39366 affects acryl-datahub. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2022-39366 and 200,000+ other known vulnerabilities.
Severity & Exploitability
CVSS Score
9.9
Exploitation is straightforward and causes maximum impact. Patch immediately.
Also Known As
PYSEC-2026-252
GHSA-r8gm-v65f-c973
Related CVEs
- CVE-2026-61447CRITICAL
PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets
- CVE-2026-61445CRITICAL
PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies