CVE detail

CVE-2024-29037 — CVE-2024-29037

Published 2024-03-20 · Modified 2026-06-17 · Vendor datahub · Product datahub-helm · Source nvd
CRITICAL
severity
CVSS-derived band
9.1
CVSS v3
0–10 scale
0.0060
EPSS probability
exploitation probability, 30d
46.0%
EPSS percentile
percentile vs all CVEs
NOT LISTED
CISA KEV
known exploited catalog

Description

datahub-helm provides the Kubernetes Helm charts for deploying Datahub and its dependencies on a Kubernetes cluster. Starting in version 0.1.143 and prior to version 0.2.182, due to configuration issues in the helm chart, if there was a successful initial deployment during a limited window of time, personal access tokens were possibly created with a default secret key. Since the secret key is a static, publicly available value, someone could inspect the algorithm used to generate personal access tokens and generate their own for an instance. Deploying with Metadata Service Authentication enabled would have been difficult during window of releases. If someone circumvented the helm settings and manually set Metadata Service Authentication to be enabled using environment variables directly, t

Remediation

No vendor-published fix data in our corpus for this CVE. Check the references below or the vendor's PSIRT / security advisories page.

References

cvedb.io · NVD · CISA KEV · FIRST EPSS · vendor advisories (CVE Program List v5). Informational only, no warranty — verify every remediation against the vendor advisory before acting on it. This product uses data from the NVD API but is not endorsed or certified by the NVD, CISA, FIRST.org or any vendor named. CVE® is a registered trademark of The MITRE Corporation.