Vulnerabilities

Filters

2 selected

12 records

Sort

Vendor: open-metadata Component: Openmetadata Clear all filters

TI-2026-21024 CVE-2026-26010 · GHSA-pqqf-7hxm-rj5r

Leaky JWTs in OpenMetadata exposing highly-privileged bot users

HIGH 66

OpenMetadata is a unified metadata platform.

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.00368 Published 2026-02-11 Fixed in 1.11.8 CWE-269

TI-2026-17854 CVE-2026-22244 · GHSA-5f29-2333-h9c7

OpenMetadata Server-Side Template Injection (SSTI) in FreeMarker email templates that leads to RCE

HIGH 72

OpenMetadata is a unified metadata platform.

CVSS 4.0HIGH 8.5 Network High privileges No interaction EPSS 0.01285 Published 2026-01-08 Fixed in 1.11.4 CWE-1336

TI-2025-32139 CVE-2025-50468 · GHSA-wjpf-mm6w-7v5v

OpenMetadata <=1.4.4 is vulnerable to SQL Injection.

LOW 37

OpenMetadata <=1.4.4 is vulnerable to SQL Injection.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00329 Published 2025-08-08 No fix listed CWE-89

TI-2025-32138 CVE-2025-50467 · GHSA-5vp8-f9v7-7v5p

OpenMetadata <=1.4.4 is vulnerable to SQL Injection.

LOW 37

OpenMetadata <=1.4.4 is vulnerable to SQL Injection.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00283 Published 2025-08-08 No fix listed CWE-89

TI-2025-32137 CVE-2025-50466 · GHSA-rm23-g9xg-gm79

OpenMetadata <=1.4.4 is vulnerable to SQL Injection.

MEDIUM 64

OpenMetadata <=1.4.4 is vulnerable to SQL Injection.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00361 Published 2025-08-08 No fix listed CWE-89

TI-2025-32136 CVE-2025-50465 · GHSA-jw6q-gq77-j944

OpenMetadata <=1.4.4 is vulnerable to SQL Injection.

LOW 38

OpenMetadata <=1.4.4 is vulnerable to SQL Injection.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00358 Published 2025-08-08 No fix listed CWE-89

TI-2024-36809 CVE-2024-55238 · GHSA-x8pm-wrg2-mqmx

OpenMetadata <=1.4.1 is vulnerable to SQL Injection.

HIGH 71

OpenMetadata <=1.4.1 is vulnerable to SQL Injection.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00621 Published 2025-04-17 No fix listed CWE-89

TI-2024-19050 CVE-2024-28848 · GHSA-5xv3-fm7g-865r

SpEL Injection in `GET /api/v1/policies/validation/condition/<expr>` in OpenMetadata

HIGH 73

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.07888 Published 2024-03-15 Fixed in 1.2.4 CWE-94

TI-2024-18814 CVE-2024-28255

Authentication Bypass in OpenMetadata

CRITICAL 87

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.73255 Published 2024-03-15 Fixed in 1.2.4 CWE-287

TI-2024-19049 CVE-2024-28847 · GHSA-8p5r-6mvv-2435

SpEL Injection in `PUT /api/v1/events/subscriptions` in OpenMetadata

HIGH 73

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02372 Published 2024-03-15 Fixed in 1.2.4 CWE-94

TI-2024-18813 CVE-2024-28254

SpEL Injection in `GET /api/v1/events/subscriptions/validation/condition/<expr>` in OpenMetadata

HIGH 73

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.45725 Published 2024-03-15 Fixed in 1.2.4 CWE-78

TI-2024-18812 CVE-2024-28253 · GHSA-7vf4-x5m2-r6gr

SpEL Injection in `PUT /api/v1/policies` in OpenMetadata

MEDIUM 63

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration.

CVSS 3.1CRITICAL 9.4 Network No auth No interaction EPSS 0.12527 Published 2024-03-15 Fixed in 1.3.1 CWE-94