Externally Controlled Reference to a Resource in Another Sphere

Information

• Advisory ID: DSA-2026-016

• CVSS Base Score: 8.8

• CVSS String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• Severity: High

• CWE classification: CWE-610

Summary

In Dataiku DSS between 13.1.0 inclusive and 14.7.6 exclusive, and in Dataiku DSS between 15.0.0 inclusive and 15.0.3 exclusive, and in Dataiku DSS between 15.1.0 inclusive and 15.2.1 exclusive, insufficient validation of git references could allow a user to read configuration files from the DSS instance and its projects.

Affected Products

• Dataiku DSS before 14.7.6

• Dataiku DSS between 15.0.0 inclusive and 15.0.3 exclusive

• Dataiku DSS between 15.1.0 inclusive and 15.2.1 exclusive

Fix

Dataiku 14.7.6, 15.0.3 and 15.2.1 have been made available to customers to remediate this issue.