pypi package report

Is acryl-datahub safe?

1 known vulnerability, worst severity CRITICAL.

// reach

230 direct dependencies

57 carry known advisories, worst CRITICAL

9 packages depend on it

an advisory here reaches each of them

Create a free accountfor every dependency path, dependent and what to upgrade
// ai model usage

No published models are known to use this package.

cvss
9.9
critical

CVSS v3.1 base score out of 10

epss
1.1%
medium

chance of exploitation in 30 days, 66th percentile of all CVEs

xyz score
4.9
medium

CyberXYZ composite out of 10

fig. 01 — GHSA-r8gm-v65f-c973, the advisory selected below

// 1 advisories

GHSA-r8gm-v65f-c973

CRITICALGitHub ratingCVE-2022-39366
// missing jwt signature check (ghsl-2022-078)

The StatelessTokenService of the DataHub metadata service (GMS) does not verify the signature of JWT tokens. This allows an attacker to connect to DataHub instances as any user if Metadata Service authentication is enabled. This vulnerability occurs because the StatelessTokenService of the Metadata service uses the parse method of io.jsonwebtoken.JwtParser, which does not perform a verification of the cryptographic token signature. This means that JWTs are accepted regardless of the used algorithm.

// impact

This issue may lead to an authentication bypass.

// resources
// cvss v3.1 vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Changed
Confidentiality
Low
Integrity
High
Availability
Low

Checked 2026-11-07 at 12:10 UTC. The most recent advisory here was published 2022-10-31. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Think a verdict here is wrong? Tell us — we respond within 2 business days.