open-metadata

Records15All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high10CVSS 7.0–8.9

Exploited now

open-metadata records in CISA KEV

No open-metadata vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Openmetadata 12 records CRITICAL

Records

15 records

TI-2024-18814 CVE-2024-28255

Authentication Bypass in OpenMetadata

CRITICAL 87

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.73255 Published 2024-03-15 Fixed in 1.2.4 CWE-287

TI-2024-19050 CVE-2024-28848 · GHSA-5xv3-fm7g-865r

SpEL Injection in `GET /api/v1/policies/validation/condition/<expr>` in OpenMetadata

HIGH 73

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.07888 Published 2024-03-15 Fixed in 1.2.4 CWE-94

TI-2024-19049 CVE-2024-28847 · GHSA-8p5r-6mvv-2435

SpEL Injection in `PUT /api/v1/events/subscriptions` in OpenMetadata

HIGH 73

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02372 Published 2024-03-15 Fixed in 1.2.4 CWE-94

TI-2024-18813 CVE-2024-28254

SpEL Injection in `GET /api/v1/events/subscriptions/validation/condition/<expr>` in OpenMetadata

HIGH 73

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.45725 Published 2024-03-15 Fixed in 1.2.4 CWE-78

TI-2026-56039 CVE-2026-81029 · GHSA-j399-mfvr-j893

OpenMetadata before 2.0.0 JWT Disclosure via Unvalidated SAML and OIDC Redirect URI

HIGH 72

OpenMetadata accepts a caller-supplied post-authentication redirect target and appends the issued token to it.

CVSS 4.0HIGH 8.5 Network No auth User interaction EPSS 0.00553 Published 2026-08-26 Fixed in 2.0.0 CWE-601

TI-2026-17854 CVE-2026-22244 · GHSA-5f29-2333-h9c7

OpenMetadata Server-Side Template Injection (SSTI) in FreeMarker email templates that leads to RCE

HIGH 72

OpenMetadata is a unified metadata platform.

CVSS 4.0HIGH 8.5 Network High privileges No interaction EPSS 0.01285 Published 2026-01-08 Fixed in 1.11.4 CWE-1336

TI-2026-34181 CVE-2026-46481 · GHSA-9vmh-whc4-7phg

OpenMetadata: TEST_CONNECTION workflow leaks ingestion-bot JWT and database password to regular users

HIGH 71

OpenMetadata is a unified metadata platform.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00241 Published 2026-06-08 Fixed in 1.12.4 CWE-201

TI-2024-36809 CVE-2024-55238 · GHSA-x8pm-wrg2-mqmx

OpenMetadata <=1.4.1 is vulnerable to SQL Injection.

HIGH 71

OpenMetadata <=1.4.1 is vulnerable to SQL Injection.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00621 Published 2025-04-17 No fix listed CWE-89

TI-2026-21024 CVE-2026-26010 · GHSA-pqqf-7hxm-rj5r

Leaky JWTs in OpenMetadata exposing highly-privileged bot users

HIGH 66

OpenMetadata is a unified metadata platform.

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.00368 Published 2026-02-11 Fixed in 1.11.8 CWE-269

TI-2025-32137 CVE-2025-50466 · GHSA-rm23-g9xg-gm79

OpenMetadata <=1.4.4 is vulnerable to SQL Injection.

MEDIUM 64

OpenMetadata <=1.4.4 is vulnerable to SQL Injection.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00361 Published 2025-08-08 No fix listed CWE-89

TI-2024-18812 CVE-2024-28253 · GHSA-7vf4-x5m2-r6gr

SpEL Injection in `PUT /api/v1/policies` in OpenMetadata

MEDIUM 63

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration.

CVSS 3.1CRITICAL 9.4 Network No auth No interaction EPSS 0.12527 Published 2024-03-15 Fixed in 1.3.1 CWE-94

TI-2026-64651 CVE-2026-100373 · GHSA-2qh3-cv3f-wh5h

OpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypass

MEDIUM 56

OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00262 Published 2026-09-25 No fix listed CWE-918

TI-2025-32136 CVE-2025-50465 · GHSA-jw6q-gq77-j944

OpenMetadata <=1.4.4 is vulnerable to SQL Injection.

LOW 38

OpenMetadata <=1.4.4 is vulnerable to SQL Injection.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00358 Published 2025-08-08 No fix listed CWE-89

TI-2025-32139 CVE-2025-50468 · GHSA-wjpf-mm6w-7v5v

OpenMetadata <=1.4.4 is vulnerable to SQL Injection.

LOW 37

OpenMetadata <=1.4.4 is vulnerable to SQL Injection.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00329 Published 2025-08-08 No fix listed CWE-89

TI-2025-32138 CVE-2025-50467 · GHSA-5vp8-f9v7-7v5p

OpenMetadata <=1.4.4 is vulnerable to SQL Injection.

LOW 37

OpenMetadata <=1.4.4 is vulnerable to SQL Injection.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00283 Published 2025-08-08 No fix listed CWE-89

Open these records in search →