OpenMetadata EUVD-2026-87316

Requires an account with permission to create or update an EventSubscription in OpenMetadata (through 2.0.2); the attacker sets a WEBHOOK destination endpoint to an internal or loopback address (e.g., http://127.0.0.1 or the cloud metadata IP 169.254.169.254), which URLValidator.validateURL fails to reject because it does not resolve DNS hostnames or validate internal/private addresses. Exploitation works on default configurations of the webhook/EventSubscription feature and requires no user interaction, but is LIMITED by PR:H - the requester must already hold the privileged EventSubscription management capability - and the leak is blind (only HTTP status codes are returned, not response bodies), constraining it to internal service and cloud-metadata probing rather than direct data exfiltration.

This is a blind SSRF (CWE-918) that carries a modest CVSS 4.0 base of 5.1, and the score is honest rather than inflated: the vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N with VC:L/SC:L reflects that impact is limited to blind internal probing (HTTP status codes returned), not data theft or code execution, and that exploitation requires PR:H - the actor must already hold permission to create or update an EventSubscription, an administrative/privileged capability. Signals partially align and partially temper each other: a public POC exists (a gist by naif-alfardan) and a vendor patch is available, and VulnCheck has published an advisory, so this is a real, reproducible issue rather than a theoretical one. However, it is NOT in CISA KEV and no EPSS score was provided, so there is no evidence of active or widespread exploitation. The PR:H gate is the dominant risk-limiting factor: the attacker is an authenticated, already-trusted user, which shifts this toward an insider/post-compromise pivot (reaching cloud metadata endpoints like 169.254.169.254 or internal services) rather than an unauthenticated internet-facing break-in. Net: a legitimate, patch-now-if-exposed issue but a moderate priority, not a critical one.

An authenticated user (or a compromised account) with rights to manage EventSubscriptions creates or PATCHes a webhook destination pointing at an internal address such as http://127.0.0.1 or the cloud metadata endpoint 169.254.169.254; because URLValidator.validateURL fails to resolve DNS and block internal addresses, the OpenMetadata server issues the request and returns HTTP status codes that let the attacker map internal services and probe cloud metadata. A public proof-of-concept exists (VulnCheck-referenced gist), lowering the effort to reproduce. Because CVSS shows AV:N/AC:L but PR:H, the attack is network-reachable and low-complexity yet requires the EventSubscription privilege.