OpenMetadata CVE-2025-9029 Unauth Access Vulnerability Analysis & PoC

Vulnerability Overview Vulnerability Name: OpenMetadata Security Vulnerability (CVE-2025-9029) Vulnerability Type: Unauthenticated Access / Information Disclosure Affected Component: OpenMetadata REST API endpoints (e.g., ) Risk Level: High (High CVSS score; risk of unauthenticated users reading sensitive metadata) Impact Scope Affected Versions: OpenMetadata 2.0.0 and earlier versions (including 2.0.0-SNAPSHOT) Impact Scenarios: - Unauthenticated users can retrieve metadata for databases, tables, columns, metrics, data products, etc., via the API - Potential leakage of sensitive information such as business semantics, data lineage, and quality rules - Affects all enterprise environments where OpenMetadata is deployed, particularly in multi-tenant or hybrid cloud scenarios Remediation Fixed Version: OpenMetadata 2.0.0 GA (General Availability) (or subsequent patched versions) Remediation Details: - Added authentication and authorization checks for all API endpoints - Implemented access controls for sensitive metadata fields - Fixed unauthenticated access issues in endpoints such as Interim Mitigation Measures: - Enforce Bearer Token requirements for the path at the gateway layer (e.g., Nginx, Kong) - Disable or restrict API endpoints that allow anonymous access - Upgrade to the fixed 2.0.0 GA version POC / Exploit Code > Note: This vulnerability has been fixed in the OpenMetadata 2.0.0 GA release. It is recommended that all users upgrade promptly and verify the API authentication mechanism.

Goal Reached Thanks to every supporter — we hit 100%!

OpenMetadata CVE-2025-9029 Unauth Access Vulnerability Analysis & PoC

More from this source