Open Metadata

CVE-2026-81029 Aug 26, 15:44 HIGH PATCH This Week

JWT token disclosure in OpenMetadata's SAML and OIDC/OAuth2 authentication flows enables account takeover by exploiting an unvalidated open redirect that appends the victim's freshly issued JWT, email, and account name to an attacker-controlled URL. All 1.x releases are affected because neither SamlLoginServlet nor the OIDC/OAuth2 handler validates the caller-supplied redirect destination against any allowlist or registered callback set. An attacker who socially engineers a victim into clicking a crafted login URL can capture the full JWT upon successful authentication and immediately assume control of that account via the OpenMetadata API. No public exploit has been identified at time of analysis, and no CISA KEV listing is confirmed.

CVE-2026-26010 Feb 11, 21:16 Maven HIGH POC PATCH This Week

OpenMetadata versions prior to 1.11.8 expose JWT tokens for the privileged ingestion-bot account through the /api/v1/ingestionPipelines API endpoint, allowing any read-only user to escalate privileges and impersonate a highly privileged service account. With public exploit code available and no patch currently deployed on most instances, attackers can perform destructive actions within OpenMetadata and access sensitive metadata that should be restricted by role-based policies. This vulnerability affects OpenMetadata deployments and related systems like PostgreSQL that depend on its authentication tokens.

CVE-2026-22244 Jan 08, 16:16 Maven HIGH POC PATCH GHSA This Week

Remote code execution in OpenMetadata versions 1.5.0 through 1.11.3 is achievable by an authenticated administrator via Server-Side Template Injection in the FreeMarker email templating engine. The platform stores administrator-supplied email template content in its database and renders it without sandboxing controls, allowing FreeMarker directives to instantiate arbitrary Java classes and execute OS commands server-side. A detailed public proof-of-concept from FPT Cloud AppSec Research Team is available; no active exploitation is confirmed in CISA KEV at time of analysis.

CVE-2024-28255 Mar 15, 20:15 CRITICAL POC THREAT Emergency

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-28254 Mar 15, 20:15 HIGH POC THREAT Act Now

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2025-50468 Aug 08, 17:15 MEDIUM POC This Week

OpenMetadata <=1.4.4 is vulnerable to SQL Injection. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2025-50467 Aug 08, 17:15 MEDIUM This Month

OpenMetadata <=1.4.4 is vulnerable to SQL Injection. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2025-50466 Aug 08, 17:15 HIGH POC This Month

OpenMetadata <=1.4.4 is vulnerable to SQL Injection. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2025-50465 Aug 08, 17:15 HIGH This Month

OpenMetadata <=1.4.4 is vulnerable to SQL Injection. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2024-55238 Apr 17, 16:15 Maven HIGH POC This Week

OpenMetadata <=1.4.1 is vulnerable to SQL Injection. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-28848 Mar 15, 20:15 Maven HIGH PATCH This Week

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2024-28847 Mar 15, 20:15 Maven HIGH POC PATCH This Week

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-28253 Mar 15, 20:15 Maven HIGH POC PATCH THREAT This Week

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.