PT-2026-35199 · Datavines · Datavines

Anch0R · Published 2026-04-26 · Updated 2026-04-26 · CVE-2026-7018

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Datavane Datavines versions prior to e540d6dc04e2e6ad11907fb655f3728a13e7b939

Description An issue exists in the JWT Token Handler component within the file datavines-core/src/main/java/io/datavines/core/utils/TokenManager.java. Manipulation of the tokenSecret argument can lead to the use of a hard-coded cryptographic key. This flaw allows for remote execution, although it requires a high level of complexity and is difficult to exploit.

Recommendations Apply patch e540d6dc04e2e6ad11907fb655f3728a13e7b939.

Exploit

Fix

Weakness Enumeration

CWE-320

CWE-321

Related Identifiers

CVE-2026-7018

Affected Products

Datavines

References · 12

• 🔥 https://github.com/datavane/datavines/issues/580#issue-4206839649 · Exploit
• https://github.com/datavane/datavines/pull/579 · Patch
• https://github.com/datavane/datavines/pull/579/changes/e540d6dc04e2e6ad11907fb655f3728a13e7b939 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-7018 · Security Note
• https://github.com/datavane/datavines/issues/580 · Note
• https://github.com/datavane/datavines · Note
• https://vuldb.com/vuln/359597/cti · Note
• https://twitter.com/CVEarity/status/2048322599919423551 · Twitter Post
• https://vuldb.com/submit/797305 · Note
• https://vuldb.com/vuln/359597 · Note
• https://twitter.com/CVEnew/status/2048481056806818266 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2048261442130846164 · Twitter Post