What’s Vulnerable › Products

open-metadata OpenMetadata vulnerabilities

15 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 10 published in the last 12 months.

Check whether your open-metadata OpenMetadata version is affected

Latest open-metadata OpenMetadata vulnerabilities

• CVE-2026-100373 — OpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypass (CVSS 4.1)
• CVE-2026-81029 — OpenMetadata before 2.0.0 JWT Disclosure via Unvalidated SAML and OIDC Redirect URI (CVSS 8.1)
• CVE-2026-46481 — OpenMetadata: TEST_CONNECTION workflow leaks ingestion-bot JWT and database password to regular users (CVSS 8.3)
• CVE-2026-26010 — Leaky JWTs in OpenMetadata exposing highly-privileged bot users (CVSS 7.6)
• CVE-2026-22244 — OpenMetadata Server-Side Template Injection (SSTI) in FreeMarker email templates that leads to RCE (CVSS 7.2)
• CVE-2025-50468 — (CVSS 6.5)
• CVE-2025-50467 — (CVSS 6.5)
• CVE-2025-50466 — (CVSS 6.5)
• CVE-2025-50465 — (CVSS 8.8)
• CVE-2024-55238 — (CVSS 8.8)
• CVE-2024-28848 — SpEL Injection in `GET /api/v1/policies/validation/condition/<expr>` in OpenMetadata (CVSS 8.8)
• CVE-2024-28847 — SpEL Injection in `PUT /api/v1/events/subscriptions` in OpenMetadata (CVSS 8.8)
• CVE-2024-28255 — Authentication Bypass in OpenMetadata (CVSS 9.8)
• CVE-2024-28254 — SpEL Injection in `GET /api/v1/events/subscriptions/validation/condition/<expr>` in OpenMetadata (CVSS 8.8)
• CVE-2024-28253 — SpEL Injection in `PUT /api/v1/policies` in OpenMetadata (CVSS 8.8)