Priority MEDIUM 56
OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses.
CVSS 4.0MEDIUM 5.1· Network · High privileges · No interaction · EPSS 0.00262 · Published 2026-09-25 · No fix listed CWE-918
Priority HIGH 72
OpenMetadata accepts a caller-supplied post-authentication redirect target and appends the issued token to it.
CVSS 4.0HIGH 8.5· Network · No auth · User interaction · EPSS 0.00553 · Published 2026-08-26 · Fixed in 2.0.0 CWE-601
Priority HIGH 71
OpenMetadata is a unified metadata platform.
CVSS 3.1HIGH 8.3· Network · Low privileges · No interaction · EPSS 0.00241 · Published 2026-06-08 · Fixed in 1.12.4 CWE-201
Priority HIGH 66
OpenMetadata is a unified metadata platform.
CVSS 3.1HIGH 7.6· Network · Low privileges · No interaction · EPSS 0.00368 · Published 2026-02-11 · Fixed in 1.11.8 CWE-269
Priority HIGH 72
OpenMetadata is a unified metadata platform.
CVSS 4.0HIGH 8.5· Network · High privileges · No interaction · EPSS 0.01285 · Published 2026-01-08 · Fixed in 1.11.4 CWE-1336
Priority LOW 37
OpenMetadata <=1.4.4 is vulnerable to SQL Injection.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00329 · Published 2025-08-08 · No fix listed CWE-89
Priority LOW 37
OpenMetadata <=1.4.4 is vulnerable to SQL Injection.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00283 · Published 2025-08-08 · No fix listed CWE-89
Priority MEDIUM 64
OpenMetadata <=1.4.4 is vulnerable to SQL Injection.
CVSS 3.1HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00361 · Published 2025-08-08 · No fix listed CWE-89
Priority LOW 38
OpenMetadata <=1.4.4 is vulnerable to SQL Injection.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00358 · Published 2025-08-08 · No fix listed CWE-89
Priority HIGH 71
OpenMetadata <=1.4.1 is vulnerable to SQL Injection.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00621 · Published 2025-04-17 · No fix listed CWE-89
Priority HIGH 73
OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.07888 · Published 2024-03-15 · Fixed in 1.2.4 CWE-94
Priority CRITICAL 87
OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.73255 · Published 2024-03-15 · Fixed in 1.2.4 CWE-287
Priority HIGH 73
OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.02372 · Published 2024-03-15 · Fixed in 1.2.4 CWE-94
Priority HIGH 73
OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.45725 · Published 2024-03-15 · Fixed in 1.2.4 CWE-78
Priority MEDIUM 63
OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration.
CVSS 3.1CRITICAL 9.4· Network · No auth · No interaction · EPSS 0.12527 · Published 2024-03-15 · Fixed in 1.3.1 CWE-94
THREATIST.IORead the docs