Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

OpenMetadata — Vulnerabilities & Security Advisories 10

All 10 CVE vulnerabilities found in OpenMetadata, with AI-generated Chinese analysis, references, and POCs.

Vendor: open-metadata

CVE ID Title CVSS Severity Published
CVE-2026-100373 OpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypass CWE-918 4.1 Medium 2026-09-25
CVE-2026-81029 OpenMetadata before 2.0.0 JWT Disclosure via Unvalidated SAML and OIDC Redirect URI CWE-601 8.1 High 2026-08-26
CVE-2026-46481 OpenMetadata: TEST_CONNECTION workflow leaks ingestion-bot JWT and database password to regular users CWE-201 8.3 High 2026-06-08
CVE-2026-26010 Leaky JWTs in OpenMetadata exposing highly-privileged bot users CWE-269 8.1AI High AI 2026-02-11
CVE-2026-22244 OpenMetadata Server-Side Template Injection (SSTI) in FreeMarker email templates that leads to RCE CWE-1336 8.5 High 2026-01-08
CVE-2024-28848 SpEL Injection in `GET /api/v1/policies/validation/condition/<expr>` in OpenMetadata CWE-94 8.8 High 2024-03-15
CVE-2024-28255 Authentication Bypass in OpenMetadata CWE-287 9.8 Critical 2024-03-15
CVE-2024-28847 SpEL Injection in `PUT /api/v1/events/subscriptions` in OpenMetadata CWE-94 8.8 High 2024-03-15
CVE-2024-28254 SpEL Injection in `GET /api/v1/events/subscriptions/validation/condition/<expr>` in OpenMetadata CWE-78 8.8 High 2024-03-15
CVE-2024-28253 SpEL Injection in `PUT /api/v1/policies` in OpenMetadata CWE-94 9.4 Critical 2024-03-15

All 10 known CVE vulnerabilities affecting OpenMetadata with full Chinese analysis, references, and POCs where available.