Skip to content
OpenAdvisories

Package · Maven

org.open-metadata:openmetadata-service

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.3
    CVE-2026-46481

    OpenMetadata: TEST_CONNECTION workflow leaks ingestion-bot JWT and database password to regular users

    OpenMetadata is a unified metadata platform. Prior to version 1.12.4, a non-admin SSO user can trigger a TEST_CONNECTION workflow for a Database Service and receive, in the HTTP 201 response of POST /api/v1/automations/workflows, both the cleartext database p…

    open-metadata OpenMetadata org.open-metadata:openmetadata-service Maven
  • High 7.1
    CVE-2024-55238

    OpenMetadata SQL Injection

    OpenMetadata <=1.4.1 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the WorkflowDAO interface. The workflowtype and status parameters can be used to build a SQL query.

    org.open-metadata:openmetadata-service Maven
  • High 8.8
    CVE-2024-28848

    SpEL Injection in `GET /api/v1/policies/validation/condition/<expr>` in OpenMetadata

    OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The `‎CompiledRule::validateExpression` method evaluates an SpEL expression using an `…

    open-metadata OpenMetadata org.open-metadata:openmetadata-service Maven
  • High 8.8
    CVE-2024-28847

    SpEL Injection in `PUT /api/v1/events/subscriptions` in OpenMetadata

    OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. Similarly to the GHSL-2023-250 issue, `AlertUtil::validateExpression` is also called f…

    open-metadata OpenMetadata org.open-metadata:openmetadata-service Maven