Security¶
Warning
Please read the important note below on October 2026 vulnerabilities
- Authentication
- Project Access
- Project folders - defaults and access
- Permissions
- Connections security
- User profiles
- Shared objects
- Authorized objects
- Secrets Manager
- User secrets
- Audit Trail
- Govern Security: Permissions
- Passwords security
- Advanced security options
- Stories security
- Messaging Channels Permissions
How Dataiku responds to the October 2026 vulnerabilities¶
Dataiku takes steps to ensure the security of its customers among the large number of severe ecosystem vulnerabilities reported in the second half of October 2026
Applicable to all customers¶
PHP¶
Dataiku does not use PHP and is not affected by the “PHP2Shell” classes of vulnerabilities
Applicable to Dataiku Cloud Customers¶
Node.js¶
Dataiku’s use of Node.js is limited. Dataiku has specifically reviewed the vulnerabilities reported in Node.js, notably the Brotli decoder vulnerability and our assessment confirms that Dataiku is not affected by these vulnerabilities.
Please note that this assessment does not extend to the eMudhra certificate issue. Please see below for this one.
Dataiku will nevertheless upgrade Node.js for Dataiku Cloud customers in the coming day, when updated OS packages become available.
Oracle Java¶
Dataiku Cloud does not use Oracle Java.
eMudhra certificates¶
The faulty eMudhra certificates have been revoked and distruted for all Dataiku Cloud customers have been upgraded. This vulnerability is resolved for these customers.
Note: For Dataiku Cloud Dedicated customers, please get in touch with your Technical Account Manager
Applicable to Dataiku Cloud Stacks customers¶
General recommendations¶
Given the influx of vulnerabilities, we recommend that you keep watch for OS packages updates, and perform security updates as usual, on a daily basis.
Node.js¶
Dataiku’s use of Node.js is limited. Dataiku has specifically reviewed the vulnerabilities reported in Node.js, notably the Brotli decoder vulnerability and our assessment confirms that Dataiku is not affected by these vulnerabilities.
Please note that this assessment does not extend to the eMudhra certificate issue. Please see below for this one.
Oracle Java¶
Dataiku Cloud Stacks does not use Oracle Java. Please note however that you may still be affected by the eMudhra certificate issue, please see below.
eMudhra certificates¶
In order to fully distrust the faulty eMudhra certificates, you need to upgrade to one of the Dataiku versions that ship with updated “certifi” Python packages:
If you are running Dataiku version older than 14, no fixed version is available. You need to upgrade. Please note that all versions before Dataiku 14 have reached end of life.
If you are running Dataiku 14, please upgrade to 14.7.6
If you are running Dataiku 15.0, please upgrade to 15.0.3
If you are running Dataiku 15.1 or 15.2, please upgrade to 15.2.1
You should then rebuild code envs, so that other copies of the “certifi” packages are updated.
Applicable to Dataiku Custom Customers¶
General recommendations¶
Given the influx of vulnerabilities, we recommend that you keep watch for OS packages updates, and perform security updates as usual, on a daily basis.
Node.js¶
Dataiku’s use of Node.js is limited. Dataiku has specifically reviewed the vulnerabilities reported in Node.js, notably the Brotli decoder vulnerability and our assessment confirms that Dataiku is not affected by these vulnerabilities.
Please note that this assessment does not extend to the eMudhra certificate issue. Please see below for this one.
Oracle Java¶
If you use Oracle Java, you are responsible for upgrading it. Please don’t forget to restart Dataiku after doing so.
eMudhra certificates¶
Please first liaise with your OS provider in order to make sure that you are running updated version of ca-certificates or similar package.
In order to fully distrust the faulty eMudhra certificates, you also need to upgrade to one of the Dataiku versions that ship with updated “certifi” Python packages:
If you are running Dataiku version older than 14, no fixed version is available. You need to upgrade. Please note that all versions before Dataiku 14 have reached end of life.
If you are running Dataiku 14, please upgrade to 14.7.6
If you are running Dataiku 15.0, please upgrade to 15.0.3
If you are running Dataiku 15.1 or 15.2, please upgrade to 15.2.1
You should then rebuild code envs, so that other copies of the “certifi” packages are updated.