[0day-rubbish] Dataedo Portal 26.2.8 with Dataedo Agent 26.2.8 unrestricted scheduler job-type deserialization to Agent-host command execution (8.1)

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-10-15 07:42 UTC
Importiert: 2026-10-15 09:17 UTC
Quelle-ID: full_disc
uid_hash: bfdd19dbd14aac8e6e49f6cb0a6eee62ecc3c86b050befd412a0d0bc4ab6da14

Full Disclosure

Posted by disclosure via Fulldisclosure on Oct 15 0day Rubbish Research Team is publicly disclosing a vulnerability in Dataedo

Portal 26.2.8 together with Dataedo Agent 26.2.8, the closed-source enterprise

data-catalog and data-governance platform from Dataedo sp. z o.o. (Poland).

Both components are in scope because the chain crosses from one to the other:

the Portal discloses a database credential, and the separately installed Agent

executes an injected scheduler job on its own host. In the...

No data

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
Full Disclosure	full_disc	threat_intel		-	de	https://seclists.org/rss/fulldisclosure.rss