OpenMetadata
open-metadata- Product type
- Other
- Catalog vulnerabilities
- 15
Severity across 10 analyzed records
Verify to analyze this security profile
en
Severity across 10 analyzed records
Verify to analyze this security profile
As of 10/06/2026, within CyStack's analyzed data, OpenMetadata has 2 security vulnerabilities published in the last 90 days. Of these, 1 is rated High or Critical. None of these vulnerabilities is listed in the CISA KEV catalog. CyStack recommends that organizations and individual users remediate applicable vulnerabilities as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of OpenMetadata and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-100373OpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypass | Exploitation statusPublic exploit | FixYes | Published09/25/2026 | SeverityMedium |
CVE-2026-81029OpenMetadata before 2.0.0 JWT Disclosure via Unvalidated SAML and OIDC Redirect URI | Exploitation statusPublic exploit | FixYes | Published08/26/2026 | SeverityHigh |
CVE-2026-46481OpenMetadata: TEST_CONNECTION workflow leaks ingestion-bot JWT and database password to regular users | Exploitation statusPublic exploit | FixYes | Published06/08/2026 | SeverityHigh |
CVE-2026-26010Leaky JWTs in OpenMetadata exposing highly-privileged bot users | Exploitation statusPublic exploit | FixYes | Published02/11/2026 | SeverityHigh |
CVE-2026-22244OpenMetadata Server-Side Template Injection (SSTI) in FreeMarker email templates that leads to RCE | Exploitation statusPublic exploit | FixNot confirmed | Published01/08/2026 | SeverityHigh |
CVE-2025-50466 | Exploitation statusPublic exploit | FixNot confirmed | Published08/08/2025 | SeverityHigh |
CVE-2025-50468 | Exploitation statusNot known exploited | FixNot confirmed | Published08/08/2025 | SeverityMedium |
CVE-2025-50465 | Exploitation statusNot known exploited | FixNot confirmed | Published08/08/2025 | SeverityHigh |
CVE-2025-50467 | Exploitation statusNot known exploited | FixNot confirmed | Published08/08/2025 | SeverityMedium |
CVE-2024-55238 | Exploitation statusPublic exploit | FixNot confirmed | Published04/17/2025 | SeverityHigh |
CVE-2024-28848SpEL Injection in `GET /api/v1/policies/validation/condition/<expr>` in OpenMetadata | Exploitation statusPublic exploit | FixYes | Published03/15/2024 | SeverityHigh |
CVE-2024-28255Authentication Bypass in OpenMetadata | Exploitation statusPublic exploit | FixNot confirmed | Published03/15/2024 | SeverityCritical |
CVE-2024-28847SpEL Injection in `PUT /api/v1/events/subscriptions` in OpenMetadata | Exploitation statusPublic exploit | FixNot confirmed | Published03/15/2024 | SeverityHigh |
CVE-2024-28254SpEL Injection in `GET /api/v1/events/subscriptions/validation/condition/<expr>` in OpenMetadata | Exploitation statusPublic exploit | FixNot confirmed | Published03/15/2024 | SeverityHigh |
CVE-2024-28253SpEL Injection in `PUT /api/v1/policies` in OpenMetadata | Exploitation statusNot known exploited | FixNot confirmed | Published03/15/2024 | SeverityCritical |