TI-2026-64651 Aliases CVE-2026-100373 GHSA-2qh3-cv3f-wh5h

OpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypass

MEDIUM 56CWE-918Published 2026-09-25 · Updated 2026-09-25

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses. Users permitted to create or update EventSubscription can set webhook destinations to internal hosts, allowing the server to send requests to private networks and cloud metadata endpoints while returning HTTP status codes that enable blind SSRF probing.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00262 18th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
open-metadata	OpenMetadata	up to 2.0.2	—	No fix listed	CNA

OpenMetadata Vendoropen-metadata Affected up to 2.0.2 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:open-metadata:openmetadata::::::::	—	—	open-metadata

cpe:2.3:a:open-metadata:openmetadata:*:*:*:*:*:*:*:* Versions — — ·open-metadata

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-100373
2026-10-03 Alias added: GHSA-2qh3-cv3f-wh5h

References

Exploit 1

https://gist.github.com/naif-alfardan/8a69e0648e11b07abe63f949346179c1

Patch 1

https://github.com/open-metadata/OpenMetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f

Other 3

TI-2024-18814 Authentication Bypass in OpenMetadata CVSS 3.1CRITICAL 9.8
TI-2024-19050 SpEL Injection in `GET /api/v1/policies/validation/condition/<expr>` in OpenMetadata CVSS 3.1HIGH 8.8
TI-2024-19049 SpEL Injection in `PUT /api/v1/events/subscriptions` in OpenMetadata CVSS 3.1HIGH 8.8
TI-2024-18813 SpEL Injection in `GET /api/v1/events/subscriptions/validation/condition/<expr>` in OpenMetadata CVSS 3.1HIGH 8.8
TI-2026-56039 OpenMetadata before 2.0.0 JWT Disclosure via Unvalidated SAML and OIDC Redirect URI CVSS 4.0HIGH 8.5
TI-2026-17854 OpenMetadata Server-Side Template Injection (SSTI) in FreeMarker email templates that leads to RCE CVSS 4.0HIGH 8.5

See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences