Log in Start free

open-metadata

Products

ProductCVEsExploitedLatest
OpenMetadata10–Sep 25, 2026

Exploited and recent CVEs

  • CVE-2026-100373 Medium 4.1 OpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypass 0.3%
  • CVE-2026-81029 High 8.1 OpenMetadata before 2.0.0 JWT Disclosure via Unvalidated SAML and OIDC Redirect URI 0.6%
  • CVE-2026-46481 High 8.3 OpenMetadata: TEST_CONNECTION workflow leaks ingestion-bot JWT and database password to regular users 0.2%
  • CVE-2026-26010 High 7.6 Leaky JWTs in OpenMetadata exposing highly-privileged bot users 0.4%
  • CVE-2026-22244 High 8.5 OpenMetadata Server-Side Template Injection (SSTI) in FreeMarker email templates that leads to RCE 1.3%
  • CVE-2024-28848 High 8.8 SpEL Injection in `GET /api/v1/policies/validation/condition/<expr>` in OpenMetadata 7.9%
  • CVE-2024-28255 Critical 9.8 Authentication Bypass in OpenMetadata 73.3%
  • CVE-2024-28847 High 8.8 SpEL Injection in `PUT /api/v1/events/subscriptions` in OpenMetadata 2.4%
  • CVE-2024-28254 High 8.8 SpEL Injection in `GET /api/v1/events/subscriptions/validation/condition/<expr>` in OpenMetadata 45.7%
  • CVE-2024-28253 Critical 9.4 SpEL Injection in `PUT /api/v1/policies` in OpenMetadata 12.5%