CVE-2026-22244
HighSummary
OpenMetadata, a unified metadata platform, versions prior to 1.11.4 are vulnerable to remote code execution via Server-Side Template Injection (SSTI) in FreeMarker email templates. An attacker must have administrative privileges to exploit the vulnerability. Version 1.11.4 contains a patch.
Risk Assessment
The risk includes the possibility of remote code execution by a privileged attacker, which could lead to full compromise of the platform and control over metadata data.
Recommendation
It is recommended to update OpenMetadata to version 1.11.4 or later as soon as possible to eliminate the vulnerability.
Other vulnerabilities in OpenMetadata
See all- CVE-2026-81029High
OpenMetadata accepts a caller-supplied post-authentication redirect target and appends the issued token to it. SamlLoginServlet reads the callback parameter and stores it in the session without validation, and the assertion consumer later formats it into a URL with the JWT and account details. The OIDC and OAuth2 handlers follow the same pattern. An attacker can craft a link that, after victim login, sends the token to an attacker-controlled destination, allowing account takeover.
- CVE-2026-46481High
In OpenMetadata prior to version 1.12.4, a non-admin SSO user can trigger a TEST_CONNECTION workflow and receive cleartext database password and ingestion bot JWT in the HTTP 201 response. The JWT can be reused to access sensitive APIs with bot privileges.
Original NVD description (English source)
OpenMetadata is a unified metadata platform. Versions prior to 1.11.4 are vulnerable to remote code execution via Server-Side Template Injection (SSTI) in FreeMarker email templates. An attacker must have administrative privileges to exploit the vulnerability. Version 1.11.4 contains a patch.