What is the CVSS score of CVE-2026-26010?

CVE-2026-26010 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of PostgreSQL are affected by CVE-2026-26010?

OpenMetadata instances prior to version 1.11.8 expose authentication credentials (JWTs) through the UI metadata ingestion API, allowing attackers to hijack service accounts with access to critical…. A patch is available.

Is there a public PoC exploit available for CVE-2026-26010?

Yes, a public proof-of-concept exploit is available for CVE-2026-26010. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-26010?

Within 24 hours: Audit access logs for /api/v1/ingestionPipelines endpoints and identify exposed JWTs; immediately rotate all ingestion-bot service account credentials and API keys for connected Glue/Redshift/Postgres systems. Within 7 days: Deploy network segmentation or WAF rules to restrict /api/v1/ingestionPipelines access to authorized internal systems only; implement enhanced monitoring on data platform access using exposed credentials. Within 30 days: Upgrade OpenMetadata to version 1.11.8 or later once available; conduct full forensic review of data access logs during exposure window for signs of unauthorized activity.

PostgreSQL CVE-2026-26010

HIGH

Improper Privilege Management (CWE-269)

2026-02-11 security-advisories@github.com

GHSA-pqqf-7hxm-rj5r

PostgreSQL Openmetadata

7.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.6 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

Low

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

PoC Detected

Feb 13, 2026 - 21:34 vuln.today

Public exploit code

CVE Published

Feb 11, 2026 - 21:16 nvd

HIGH 7.6

DescriptionGitHub Advisory

OpenMetadata is a unified metadata platform. Prior to 1.11.8, calls issued by the UI against /api/v1/ingestionPipelines leak JWTs used by ingestion-bot for certain services (Glue / Redshift / Postgres). Any read-only user can gain access to a highly privileged account, typically which has the Ingestion Bot Role. This enables destructive changes in OpenMetadata instances, and potential data leakage (e.g. sample data, or service metadata which would be unavailable per roles/policies). This vulnerability is fixed in 1.11.8.

AnalysisAI

OpenMetadata versions prior to 1.11.8 expose JWT tokens for the privileged ingestion-bot account through the /api/v1/ingestionPipelines API endpoint, allowing any read-only user to escalate privileges and impersonate a highly privileged service account. With public exploit code available and no patch currently deployed on most instances, attackers can perform destructive actions within OpenMetadata and access sensitive metadata that should be restricted by role-based policies. This vulnerability affects OpenMetadata deployments and related systems like PostgreSQL that depend on its authentication tokens.

Technical ContextAI

Classified as CWE-269 (Improper Privilege Management). Affects Openmetadata. OpenMetadata is a unified metadata platform. Prior to 1.11.8, calls issued by the UI against /api/v1/ingestionPipelines leak JWTs used by ingestion-bot for certain services (Glue / Redshift / Postgres). Any read-only user can gain access to a highly privileged account, typically which has the Ingestion Bot Role. This enables destructive changes in OpenMetadata instances, and potential data leakage (e.g. sample data, or service metadata which would be unavailable per roles/policies). This vulnera