open-metadata OpenMetadata vulnerabilities
10 published CVEs name open-metadata OpenMetadata among the affected products.
- 10Published CVEs10 of them scored
- 5Last 12 monthspublished in the last year
- 2Critical7 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-100373
OpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypass
open-metadata · OpenMetadata
Medium5.1 - CVE-2026-81029
OpenMetadata before 2.0.0 JWT Disclosure via Unvalidated SAML and OIDC Redirect URI
open-metadata · OpenMetadata
High8.5 - CVE-2026-46481
OpenMetadata: TEST_CONNECTION workflow leaks ingestion-bot JWT and database password to regular users
open-metadata · OpenMetadata
High8.3 - CVE-2026-26010
Leaky JWTs in OpenMetadata exposing highly-privileged bot users
open-metadata · OpenMetadata
High7.6 - CVE-2026-22244
OpenMetadata Server-Side Template Injection (SSTI) in FreeMarker email templates that leads to RCE
open-metadata · OpenMetadata
High8.5 - CVE-2024-28848
SpEL Injection in `GET /api/v1/policies/validation/condition/<expr>` in OpenMetadata
open-metadata · OpenMetadata
High8.8 - CVE-2024-28255
Authentication Bypass in OpenMetadata
open-metadata · OpenMetadata
Critical9.8 - CVE-2024-28847
SpEL Injection in `PUT /api/v1/events/subscriptions` in OpenMetadata
open-metadata · OpenMetadata
High8.8 - CVE-2024-28254
SpEL Injection in `GET /api/v1/events/subscriptions/validation/condition/<expr>` in OpenMetadata
open-metadata · OpenMetadata
High8.8 - CVE-2024-28253
SpEL Injection in `PUT /api/v1/policies` in OpenMetadata
open-metadata · OpenMetadata
Critical9.4