Note: This data is for reference and cybersecurity research purposes only.CyStack advises users not to use this information for unlawful purposes.
CVE-2026-100373 is a vulnerability classified as Server-Side Request Forgery (SSRF), affecting OpenMetadata (affected versions: ≤ 2.0.2). This vulnerability is rated Medium, with a CVSS score of 5.1. Public exploit code or evidence is available for this vulnerability, but that does not confirm exploitation in the wild.
The analysis could not be completed. The original vulnerability data remains available below.
OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses. Users permitted to create or update EventSubscription can set webhook destinations to internal hosts, allowing the server to send requests to private networks and cloud metadata endpoints while returning HTTP status codes that enable blind SSRF probing.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
en
