Insufficient access control could allow attackers to obtain temporary cloud credentials

Information

• Advisory ID: DSA-2026-024

• CVSS Base Score: 8.8

• CVSS String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• Severity: High

• CWE classification: CWE-284

Summary

In Dataiku before 14.7.7, and in Dataiku between 15.0.0 inclusive and 15.2.2 exclusive, insufficient access control could allow authenticated attackers to obtain temporary cloud tokens with the identity of Dataiku, allowing a privilege escalation These tokens could allow attackers to escalate their privileges in the cloud environment.

Affected Products

• Dataiku before 14.7.7

• Dataiku between 15.0.0 inclusive and 15.2.2 exclusive

Fix

Dataiku 14.7.7 and 15.2.2 have been made available to customers to remediate this issue.