CVE-2026-100373— OpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypass
Quick assessment
Affected
open-metadata OpenMetadata
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
OpenMetadata 2.0.2 及之前版本在 URLValidator.validateURL 函数中存在服务端请求伪造（SSRF）漏洞。该函数未能正确解析 DNS 主机名并验证内部地址。拥有创建或更新 EventSubscription 权限的用户，可将 Webhook 目标地址设置为内部主机，从而使服务器向私有网络和云元数据端点发送请求，并返回可用于盲 SSRF 探测的 HTTP 状态码。
Possible ATT&CK Techniques 3 AI
T1557 · Adversary-in-the-Middle T1598 · Phishing for Information T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-100373
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypass
Source: CVE Program / CVE List V5
Vulnerability Description
OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses. Users permitted to create or update EventSubscription can set webhook destinations to internal hosts, allowing the server to send requests to private networks and cloud metadata endpoints while returning HTTP status codes that enable blind SSRF probing.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| open-metadata | OpenMetadata | 0 ~ 2.0.2 | - |
|
II. Public POCs for CVE-2026-100373
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-100373
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-100373 (1)
Vendor Advisories for CVE-2026-100373 (2)
Proof of Concept for CVE-2026-100373 (1)
-
🔗 Server-Side Request Forgery (SSRF) in OpenMetadata EventSubscription Webhooks · GitHub Read full article exploit third-party-advisory
Security Blog Posts for CVE-2026-100373 (1)
IV. Related Vulnerabilities
Same product: OpenMetadata
-
CVE-2026-81029
OpenMetadata before 2.0.0 JWT Disclosure via Unvalidated SAM -
CVE-2026-46481
OpenMetadata: TEST_CONNECTION workflow leaks ingestion-bot J -
CVE-2026-26010
Leaky JWTs in OpenMetadata exposing highly-privileged bot us -
CVE-2026-22244
OpenMetadata Server-Side Template Injection (SSTI) in FreeMa -
CVE-2024-28848
SpEL Injection in `GET /api/v1/policies/validation/condition
Same vendor: open-metadata
-
CVE-2026-81029
OpenMetadata before 2.0.0 JWT Disclosure via Unvalidated SAM -
CVE-2026-46481
OpenMetadata: TEST_CONNECTION workflow leaks ingestion-bot J -
CVE-2026-26010
Leaky JWTs in OpenMetadata exposing highly-privileged bot us -
CVE-2026-22244
OpenMetadata Server-Side Template Injection (SSTI) in FreeMa -
CVE-2024-28848
SpEL Injection in `GET /api/v1/policies/validation/condition
Same weakness: CWE-918
-
CVE-2026-82375
Apache Roller: Server-side request forgery via entry trackba -
CVE-2026-100750
Joomla Extension - regularlabs.com - Arbitrary file read / S -
CVE-2026-101005
October CMS SSRF Protection ResizeImages.php validateExterna -
CVE-2026-100909
OctoberCMS ResizeImages.php getSourcePathForResize server-si -
CVE-2026-100901
athlon1600 youtube-downloader stream.php stream server-side
V. Comments for CVE-2026-100373
No comments yet