CVE-2026-100373
MediumCVSS 4.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses. Users permitted to create or update EventSubscription can set webhook destinations to internal hosts, allowing the server to send requests to private networks and cloud metadata endpoints while returning HTTP status codes that enable blind SSRF probing.
Risk Assessment
An attacker can exploit SSRF to access internal network resources and cloud metadata, potentially leading to sensitive information leakage or further attacks.
Recommendation
It is recommended to update OpenMetadata to a version newer than 2.0.2 that contains the fix, and restrict permissions to create EventSubscription.
Other vulnerabilities in OpenMetadata
See all- CVE-2026-81029High
OpenMetadata accepts a caller-supplied post-authentication redirect target and appends the issued token to it. SamlLoginServlet reads the callback parameter and stores it in the session without validation, and the assertion consumer later formats it into a URL with the JWT and account details. The OIDC and OAuth2 handlers follow the same pattern. An attacker can craft a link that, after victim login, sends the token to an attacker-controlled destination, allowing account takeover.
- CVE-2026-46481High
In OpenMetadata prior to version 1.12.4, a non-admin SSO user can trigger a TEST_CONNECTION workflow and receive cleartext database password and ingestion bot JWT in the HTTP 201 response. The JWT can be reused to access sensitive APIs with bot privileges.
- CVE-2026-22244High
OpenMetadata versions 1.5.0 through 1.11.3 are vulnerable to remote code execution via Server-Side Template Injection (SSTI) in FreeMarker email templates. An attacker must have administrative privileges. Version 1.11.4 contains a patch.
Original NVD description (English source)
OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses. Users permitted to create or update EventSubscription can set webhook destinations to internal hosts, allowing the server to send requests to private networks and cloud metadata endpoints while returning HTTP status codes that enable blind SSRF probing.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS