OpenMetadata
- Software type
- Other
- Total vulnerabilities (90 days)
- 2
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
Verify to analyze this security profile
As of 10/23/2026, OpenMetadata recorded 2 security vulnerabilities in the last 90 days, of which 1 is rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of OpenMetadata and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-100373OpenMetadata through 2.0.2 SSRF via Webhook URL Validation BypassCVE-2026-81029OpenMetadata before 2.0.0 JWT Disclosure via Unvalidated SAML and OIDC Redirect URICVE-2026-46481OpenMetadata: TEST_CONNECTION workflow leaks ingestion-bot JWT and database password to regular usersCVE-2026-26010Leaky JWTs in OpenMetadata exposing highly-privileged bot usersCVE-2026-22244OpenMetadata Server-Side Template Injection (SSTI) in FreeMarker email templates that leads to RCE| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-100373OpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypass | Exploitation statusActively exploited | FixYes | Published09/25/2026 | SeverityMedium |
CVE-2026-81029OpenMetadata before 2.0.0 JWT Disclosure via Unvalidated SAML and OIDC Redirect URI | Exploitation statusActively exploited | FixYes | Published08/26/2026 | SeverityHigh |
CVE-2026-46481OpenMetadata: TEST_CONNECTION workflow leaks ingestion-bot JWT and database password to regular users | Exploitation statusActively exploited | FixYes | Published06/08/2026 | SeverityHigh |
CVE-2026-26010Leaky JWTs in OpenMetadata exposing highly-privileged bot users | Exploitation statusActively exploited | FixYes | Published02/11/2026 | SeverityHigh |
CVE-2026-22244OpenMetadata Server-Side Template Injection (SSTI) in FreeMarker email templates that leads to RCE | Exploitation statusActively exploited | FixNo | Published01/08/2026 | SeverityHigh |
CVE-2025-50465CVE-2025-50465 | Exploitation statusNot exploited | FixNo | Published08/08/2025 | SeverityHigh |
CVE-2025-50466CVE-2025-50466 | Exploitation statusActively exploited | FixNo | Published08/08/2025 | SeverityHigh |
CVE-2025-50468CVE-2025-50468 | Exploitation statusNot exploited | FixNo | Published08/08/2025 | SeverityMedium |
CVE-2025-50467CVE-2025-50467 | Exploitation statusNot exploited | FixNo | Published08/08/2025 | SeverityMedium |
CVE-2024-55238CVE-2024-55238 | Exploitation statusActively exploited | FixNo | Published04/17/2025 | SeverityHigh |
15 Results | Page 1 of 2