Open-metadata Openmetadata vulnerabilities

• open-metadata openmetadata OpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypass CVE-2026-100373 5.1 MediumSeptember 25, 2026
• open-metadata openmetadata OpenMetadata before 2.0.0 JWT Disclosure via Unvalidated SAML and OIDC Redirect URI CVE-2026-81029 8.5 HighAugust 26, 2026
• open-metadata openmetadata OpenMetadata: TEST_CONNECTION workflow leaks ingestion-bot JWT and database password to regular users CVE-2026-46481 Fix available 8.3 HighMay 21, 2026
• open-metadata openmetadata Leaky JWTs in OpenMetadata exposing highly-privileged bot users CVE-2026-26010 Fix available 7.6 HighFebruary 11, 2026
• open-metadata openmetadata OpenMetadata Server-Side Template Injection (SSTI) in FreeMarker email templates that leads to RCE CVE-2026-22244 Fix available 8.5 HighJanuary 7, 2026
• open-metadata openmetadata OpenMetadata <=1.4.4 is vulnerable to SQL Injection. An attacker can extract information from the... CVE-2025-50468 6.5 MediumAugust 8, 2025
• open-metadata openmetadata OpenMetadata <=1.4.4 is vulnerable to SQL Injection. An attacker can extract information from the... CVE-2025-50467 6.5 MediumAugust 8, 2025
• open-metadata openmetadata OpenMetadata <=1.4.4 is vulnerable to SQL Injection. An attacker can extract information from the... CVE-2025-50466 7.1 HighAugust 8, 2025
• open-metadata openmetadata OpenMetadata <=1.4.4 is vulnerable to SQL Injection. An attacker can extract information from the... CVE-2025-50465 7.1 HighAugust 8, 2025
• open-metadata openmetadata OpenMetadata SQL Injection CVE-2024-55238 7.1 HighApril 17, 2025
• open-metadata openmetadata SpEL Injection in `GET /api/v1/policies/validation/condition/<expr>` in OpenMetadata CVE-2024-28848 Fix available 8.8 HighMarch 15, 2024
• open-metadata openmetadata Authentication Bypass in OpenMetadata CVE-2024-28255 Public exploit EPSS 73.3% 9.8 CriticalMarch 15, 2024
• open-metadata openmetadata SpEL Injection in `PUT /api/v1/events/subscriptions` in OpenMetadata CVE-2024-28847 Fix available 8.8 HighMarch 15, 2024
• open-metadata openmetadata SpEL Injection in `GET /api/v1/events/subscriptions/validation/condition/<expr>` in OpenMetadata CVE-2024-28254 Public exploit EPSS 45.7% 8.8 HighMarch 15, 2024
• open-metadata openmetadata SpEL Injection in `PUT /api/v1/policies` in OpenMetadata CVE-2024-28253 Fix available EPSS 12.5% 9.4 CriticalMarch 15, 2024