Vulnerability · Published Sep 25, 2026 · Assigned by VulnCheck

CVE-2026-100373OpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypass

Medium 4.1

In plain English

A medium-severity server-side request forgery in OpenMetadata from open-metadata. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)4.1Medium

Exploit odds (30 days)0.3%top 81.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses. Users permitted to create or update EventSubscription can set webhook destinations to internal hosts, allowing the server to send requests to private networks and cloud metadata endpoints while returning HTTP status codes that enable blind SSRF probing.

Affected products (as reported)

Vendor	Product	Versions
open-metadata	OpenMetadata	0 – through 2.0.2

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

References

https://gist.github.com/naif-alfardan/8a69e0648e11b07abe63f949346179c1 exploit, third-party-advisory
https://github.com/open-metadata/OpenMetadata/issues/32592 issue-tracking
https://github.com/open-metadata/OpenMetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f patch
https://github.com/open-metadata/OpenMetadata/blob/2.0.2-release/openmetadata-service/src/main/java/org/openmetadata/service/util/URLValidator.java#L34-L47 technical-description
https://github.com/open-metadata/OpenMetadata product
VulnCheck Advisory: OpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypass third-party-advisory