CVE-2026-25644: 
DataHub vulnerability analysis and mitigation

CVE-2026-25644 is a TLS downgrade vulnerability in DataHub's LDAP ingestion source that enables man-in-the-middle (MITM) attacks, allowing unauthenticated network attackers to intercept LDAP credentials in plaintext. It affects all DataHub versions prior to 1.3.1.8 and was published on February 6, 2026. The vulnerability was patched in version 1.3.1.8, released shortly after disclosure. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat CVE).

The root cause is improper certificate validation (CWE-295) in metadata-ingestion/src/datahub/ingestion/source/ldap.py. The vulnerable code hardcodes the following option: ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_ALLOW), which instructs the LDAP client to accept TLS connections even when certificate validation fails — including hostname mismatches and untrusted certificate issuers. The vulnerability is compounded by the absence of any configuration parameter (OPT_X_TLS_CACERTFILE) to specify a trusted CA certificate, meaning even if validation were attempted, no trusted anchor could be configured. An attacker positioned on the network path between DataHub and the LDAP server can present a rogue certificate and successfully intercept LDAPS credentials (GitHub Advisory).

Successful exploitation allows an unauthenticated network attacker to intercept LDAP credentials transmitted during DataHub's metadata ingestion process, resulting in a high confidentiality impact. Stolen LDAP credentials could enable unauthorized access to directory services, potentially facilitating lateral movement across the organization's authentication infrastructure. There is no integrity or availability impact, but credential theft from a directory service can have broad downstream consequences (GitHub Advisory, Feedly).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.027%, reflecting a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Credit for discovery goes to Arad Inbar, Nir Somech, and Ben Grinberg of DREAM (GitHub Advisory).

1. Network Positioning: Gain a man-in-the-middle position on the network segment between the DataHub instance and the LDAP/LDAPS server (e.g., via ARP spoofing, rogue DNS, or compromised network infrastructure).
2. TLS Interception Setup: Deploy a TLS interception proxy (e.g., mitmproxy, Burp Suite, or a custom tool) configured to present a self-signed or rogue certificate for the LDAP server's hostname.
3. Trigger LDAP Ingestion: Wait for or trigger a DataHub LDAP ingestion job. Because OPT_X_TLS_ALLOW is hardcoded, the DataHub client will accept the rogue certificate without error.
4. Capture Credentials: Intercept the LDAP bind request, which contains the LDAP service account credentials (DN and password) in plaintext within the now-decrypted TLS session.
5. Leverage Stolen Credentials: Use the captured LDAP credentials to authenticate directly to the LDAP/Active Directory server, enumerate directory objects, or pivot to other systems that trust the same credentials (GitHub Advisory).

• Network: Unexpected TLS certificate presented to DataHub from the LDAP server with an untrusted issuer or hostname mismatch (normally suppressed by OPT_X_TLS_ALLOW); unusual ARP traffic or DNS responses redirecting LDAP server hostname to an unexpected IP.
• Logs: DataHub ingestion logs showing LDAP connections to unexpected IP addresses; LDAP server authentication logs showing bind attempts from IP addresses other than the DataHub host.
• Process/Application: DataHub LDAP ingestion jobs completing successfully despite network anomalies that would normally cause TLS failures; unexpected LDAP bind activity from service accounts outside of scheduled ingestion windows.

Upgrade DataHub to version 1.3.1.8 or later, which resolves the hardcoded OPT_X_TLS_ALLOW setting and adds proper certificate validation. As an interim workaround, restrict network access so that DataHub and the LDAP server communicate only over a fully internal, trusted network segment where MITM attacks are not feasible. Additionally, monitor LDAP authentication logs for anomalous bind activity and consider implementing network segmentation to isolate the DataHub-to-LDAP communication path (GitHub Advisory).

The vulnerability was credited to researchers Arad Inbar, Nir Somech, and Ben Grinberg from DREAM, who also presented related research at Black Hat Asia. The GitHub advisory references a similar issue (CVE-2025-12765) documented by Wiz, suggesting this class of TLS misconfiguration in data ingestion tools is a recognized research area. Community coverage has been limited to automated vulnerability tracking platforms and security feeds (GitHub Advisory).