OpenMetadata CVE-2026-22244

Exploitation requires a valid OpenMetadata administrator-level JWT token or session; the CVSS PR:H metric confirms this. The attacker must be able to reach the REST API endpoint PATCH /api/v1/docStore/{templateId} over the network. Payload execution additionally requires that an email notification event be triggered - either by a system action (password change, user invitation, account activity) or, if SMTP is configured, via a test email. No non-default configuration is required beyond possession of an admin account. The primary factor limiting exploitation is the administrative credential requirement: an attacker without prior privileged access cannot exploit this vulnerability directly from an external position. Exploitation is further constrained to environments where the API is network-reachable from the attacker's position.

The CVSS 4.0 score of 8.5 with full C/I/A impact on both vulnerable and subsequent systems reflects the severity of unauthenticated-to-server RCE - but PR:H is the critical moderating factor: this flaw is only reachable with a valid administrator session token. The EPSS score of 0.46% at the 64th percentile is notably low given that a detailed public PoC exists, which typically elevates EPSS substantially; this divergence suggests exploitation has remained targeted and credential-gated rather than opportunistic. The CVSS 4.0 supplemental metric E:P (proof-of-concept exploit) aligns with the confirmed PoC from the GHSA advisory. The scope change to SC:H/SI:H/SA:H is well-founded: code execution under the OpenMetadata service account in a data governance platform can expose connection credentials, data lake access tokens, and downstream pipeline configurations. The absence of a CISA KEV listing as of this analysis means confirmed in-the-wild exploitation has not been established by a government authority. Overall, this is a high-severity finding for any organization where OpenMetadata administrator accounts could be compromised - but the admin-only prerequisite means it is not a perimeter-breach vector on its own.

An attacker who has obtained valid OpenMetadata administrator credentials - through phishing, credential stuffing, or lateral movement - sends a crafted PATCH request to /api/v1/docStore/{templateId} replacing an email template body with the FreeMarker payload <#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")}. The payload is persisted to the MySQL docStore, and when any subsequent email notification (password reset, user invitation, or a manually triggered test email) fires, FreeMarker renders the template and executes the OS command as the OpenMetadata service account. A full working PoC is publicly documented in GHSA-5f29-2333-h9c7.