DataHub versions before 1.3.1.8 contained an LDAP ingestion source that accepts downgraded TLS connections, allowing a man‑in‑the‑middle attacker to intercept or tamper with LDAP traffic. This flaw, classified as CWE‑295, permits unauthorized modification or theft of credentials and other metadata exchanged during LDAP queries, thereby undermining both confidentiality and integrity of the data collected by DataHub.

The vulnerability impacts the open‑source DataHub platform by datahub-project. All installations running any version older than 1.3.1.8 are susceptible; the fix is delivered in version 1.3.1.8 and later.

The CVSS score of 7.5 places the weakness in the high‑risk category, while the EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited. Based on the description, it is inferred that an attacker would need the ability to influence the TLS handshake of the LDAP ingestion connector, which typically requires network access to the DataHub service or a compromised LDAP server.