CVE-2024-22409 Overview
DataHub is an open-source metadata platform used to catalog and govern data assets across enterprise environments. CVE-2024-22409 is a broken access control vulnerability [CWE-276] affecting DataHub versions prior to 0.12.1. The default privilege configuration granted low-privileged users the ability to remove users, edit group memberships, and modify other users' profile information. Attackers with basic authenticated access can abuse these permissions to escalate to administrator privileges when an admin-privileged group exists in the deployment. The DataHub maintainers addressed the issue in pull request #9067 by constraining the default privilege set.
Critical Impact
A low-privileged authenticated user can escalate to administrator privileges by manipulating group memberships and user profiles, leading to full compromise of the metadata platform.
Affected Products
- DataHub versions prior to 0.12.1
- Self-hosted DataHub deployments using default privilege configurations
- Instances where an administrator-privileged group exists
Discovery Timeline
- 2024-01-16 - CVE-2024-22409 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-22409
Vulnerability Analysis
The vulnerability is a broken access control issue rooted in permissive default privileges. DataHub's role-based access control assigned overly broad capabilities to the default low-privilege user role. Authenticated users could invoke user management and group management operations without holding administrative roles.
An attacker with a standard DataHub account can add themselves to a group that carries administrative privileges. Once added, the attacker inherits admin capabilities across the metadata platform. The attacker can also modify another user's profile fields or delete users to disrupt operations.
The network-exposed attack surface combined with low required privileges makes exploitation straightforward in unmodified deployments. Instances that customized the default privilege matrix may not be affected.
Root Cause
The root cause is CWE-276: Incorrect Default Permissions. The default policy set bundled with DataHub granted permissions such as MANAGE_USERS_AND_GROUPS and profile-edit capabilities to low-privileged roles. These permissions should have been reserved for administrators. The fix in PR #9067 removes these permissions from the default low-privileged role.
Attack Vector
Exploitation requires network access to the DataHub GraphQL API and a valid low-privileged account. The attacker issues authenticated GraphQL mutations against endpoints that manage users and groups. By adding their own user identifier to an existing group that holds admin policies, the attacker gains administrator rights on the next session evaluation. No user interaction is required. See the GitHub Security Advisory GHSA-x3v6-r479-m4xv for maintainer-authored technical details.
Detection Methods for CVE-2024-22409
Indicators of Compromise
- Unexpected additions of non-admin user identifiers to groups that carry administrative policies
- Profile modification events targeting other users initiated by non-admin accounts
- User deletion events originating from accounts that historically only read metadata
- GraphQL mutations invoking addGroupMembers, updateCorpUserProperties, or removeUser from low-privileged principals
Detection Strategies
- Audit DataHub access policy assignments and compare current group membership against a known-good baseline
- Review DataHub application logs for authorization decisions that permitted user or group mutations from non-admin actors
- Correlate authentication events with subsequent policy-changing GraphQL operations to spot anomalous privilege activity
Monitoring Recommendations
- Forward DataHub GMS audit logs to a centralized SIEM and alert on user or group modification events
- Track membership changes on any group referenced by administrative policies as a high-severity signal
- Monitor for the DataHub version banner to ensure all instances run 0.12.1 or later
How to Mitigate CVE-2024-22409
Immediate Actions Required
- Upgrade DataHub to version 0.12.1 or later on all instances
- Review and remove unexpected members from groups that hold administrative policies
- Rotate credentials for any user accounts observed performing anomalous user or group mutations
- Inventory custom policies and confirm that low-privileged roles do not retain user or group management permissions
Patch Information
The issue is fixed in DataHub 0.12.1. The remediation is implemented in datahub-project/datahub PR #9067, which constrains the default privileges granted to low-privileged users. Operators who upgrade should also re-review any policies they customized before the patch, since the fix only adjusts the shipped defaults.
Workarounds
- If immediate upgrade is not possible, modify the default DataHub policies to remove MANAGE_USERS_AND_GROUPS and profile-edit permissions from low-privileged roles
- Restrict network access to the DataHub GMS and frontend to trusted administrators until the patch is applied
- Temporarily disable or restrict membership of any group that carries admin-level policies to reduce the escalation target
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
