org.open-metadata:openmetadata-dist (demo_beta1) potentially affected by CVE-2026-46481 via org.open-metadata:openmetadata-service (demo_beta1)

org.open-metadata:openmetadata-service MAVEN version demobeta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.open-metadata:openmetadata-service and may be impacted: - org.open-metadata:openmetadata-dist demobeta1 Source cves: CVE-2026-46481 Sourc...

GHSA-9VMH-WHC4-7PHG OpenMetadata: TEST_CONNECTION workflow leaks ingestion-bot JWT and database password to regular users

This is not applicable if an application is configuring the Secrets Store to store credentials. Please make sure to follow the best practices when deploying in production In OpenMetadata 1.12.1, a non-admin SSO user can trigger a TESTCONNECTION workflow for a Database Service and receive, in the...

org.open-metadata:openmetadata-dist (0.12.1) potentially affected by CVE-2026-46481 via org.open-metadata:openmetadata-service (0.12.1)

org.open-metadata:openmetadata-service MAVEN version 0.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.open-metadata:openmetadata-service and may be impacted: - org.open-metadata:openmetadata-dist 0.12.1 Source cves: CVE-2026-46481 Source...

PT-2026-42613

This is not applicable if an application is configuring the Secrets Store to store credentials. Please make sure to follow the best practices when deploying in production In OpenMetadata 1.12.1, a non-admin SSO user can trigger a TEST CONNECTION workflow for a Database Service and receive, in the...

PT-2026-42663

Name of the Vulnerable Software and Affected Versions OpenMetadata versions prior to 1.12.4 Description A non-admin SSO user can trigger a TEST CONNECTION workflow for a Database Service and receive sensitive information in the HTTP 201 response of the 'POST /api/v1/automations/workflows' endpoin...

openmetadata-airflow-managed-apis (>=0.1.0, <=0.10.0.1) potentially affected by CVE-2026-27173 via apache-airflow-providers-cncf-kubernetes (6.1.0)

apache-airflow-providers-cncf-kubernetes PYPI version 6.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-cncf-kubernetes and may be impacted: - openmetadata-airflow-managed-apis =0.1.0, =0.10.0.1 Source cves: CVE-2026-27173...

alvin-cli (>=1.3.0rc1, <=1.3.0), openmetadata-sqllineage (>=1.1.0.2, <=1.1.0.3) +1 more potentially affected by CVE-2026-46374 via sqlfluff (2.1.2)

sqlfluff PYPI version 2.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - alvin-cli =1.3.0rc1, =1.1.0.2, =1.1.0.3 - sqlfluff-templater-dbt 2.1.2 Source cves: CVE-2026-46374 Source advisory: OSV:GHSA-73JC-5MRQ-PRW7...

collate-sqllineage (>=1.1.5, <=1.2.4), openmetadata-ingestion (>=1.0.0.0, <=1.0.1.3) +3 more potentially affected by CVE-2026-46374 via sqlfluff (2.1.4)

sqlfluff PYPI version 2.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - collate-sqllineage =1.1.5, =1.0.0.0, =1.0.1.3 - openmetadata-sqllineage 1.1.2.0 - sqlfluff-templater-dbt 2.1.4 - sqllineage 1.4.7 Source cves:...

cumulus-library (>=0.1.2, <=1.4.0), cumulus-library-covid (>=0.1.2, <=0.2.2) +3 more potentially affected by CVE-2026-46374 via sqlfluff (2.0.2)

sqlfluff PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - cumulus-library =0.1.2, =0.1.2, =0.13.3.1, =1.0.3, =1.1.0.1 - sqlfluff-templater-dbt 2.0.2 Source cves: CVE-2026-46374 Source advisory:...

openmetadata-ingestion (>=0.13.2.6, <=0.13.3.0), openmetadata-sqllineage (1.0.2) +1 more potentially affected by CVE-2026-46374 via sqlfluff (2.0.0a6)

sqlfluff PYPI version 2.0.0a6 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - openmetadata-ingestion =0.13.2.6, =0.13.3.0 - openmetadata-sqllineage 1.0.2 - sqlfluff-templater-dbt 2.0.0a6 Source cves: CVE-2026-46374 Sourc...

apache-airflow-providers-fastetl (>=0.0.36, <=0.0.39), cdbt (>=0.4.6, <=0.4.9) +3 more potentially affected by CVE-2026-46374 via sqlfluff (3.0.7)

sqlfluff PYPI version 3.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - apache-airflow-providers-fastetl =0.0.36, =0.4.6, =1.3.1, =1.3.0.0, =1.4.8.1 - sqlfluff-templater-dbt 3.0.7 Source cves: CVE-2026-46374 Source...

openmetadata-ingestion (>=0.13.2.6, <=0.13.3.0), openmetadata-sqllineage (1.0.2) +1 more potentially affected by CVE-2026-46373 via sqlfluff (2.0.0a6)

sqlfluff PYPI version 2.0.0a6 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - openmetadata-ingestion =0.13.2.6, =0.13.3.0 - openmetadata-sqllineage 1.0.2 - sqlfluff-templater-dbt 2.0.0a6 Source cves: CVE-2026-46373 Sourc...

cumulus-library (>=0.1.2, <=1.4.0), cumulus-library-covid (>=0.1.2, <=0.2.2) +3 more potentially affected by CVE-2026-46373 via sqlfluff (2.0.2)

sqlfluff PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - cumulus-library =0.1.2, =0.1.2, =0.13.3.1, =1.0.3, =1.1.0.1 - sqlfluff-templater-dbt 2.0.2 Source cves: CVE-2026-46373 Source advisory:...

alvin-cli (>=1.3.0rc1, <=1.3.0), openmetadata-sqllineage (>=1.1.0.2, <=1.1.0.3) +1 more potentially affected by CVE-2026-46373 via sqlfluff (2.1.2)

sqlfluff PYPI version 2.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - alvin-cli =1.3.0rc1, =1.1.0.2, =1.1.0.3 - sqlfluff-templater-dbt 2.1.2 Source cves: CVE-2026-46373 Source advisory: OSV:GHSA-WMHF-FQC8-VXHH...

collate-sqllineage (>=1.1.5, <=1.2.4), openmetadata-ingestion (>=1.0.0.0, <=1.0.1.3) +3 more potentially affected by CVE-2026-46373 via sqlfluff (2.1.4)

sqlfluff PYPI version 2.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - collate-sqllineage =1.1.5, =1.0.0.0, =1.0.1.3 - openmetadata-sqllineage 1.1.2.0 - sqlfluff-templater-dbt 2.1.4 - sqllineage 1.4.7 Source cves:...

apache-airflow-providers-fastetl (>=0.0.36, <=0.0.39), cdbt (>=0.4.6, <=0.4.9) +3 more potentially affected by CVE-2026-46373 via sqlfluff (3.0.7)

sqlfluff PYPI version 3.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - apache-airflow-providers-fastetl =0.0.36, =0.4.6, =1.3.1, =1.3.0.0, =1.4.8.1 - sqlfluff-templater-dbt 3.0.7 Source cves: CVE-2026-46373 Source...

airtel-airflow-plugins (1.5.0), openmetadata-airflow-managed-apis (>=0.1.0, <=0.10.0.1) potentially affected by CVE-2026-38743 via apache-airflow (2.3.2)

apache-airflow PYPI version 2.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airtel-airflow-plugins 1.5.0 - openmetadata-airflow-managed-apis =0.1.0, =0.10.0.1 Source cves: CVE-2026-38743 Source advisory:...

airtel-airflow-plugins (1.5.0), openmetadata-airflow-managed-apis (>=0.1.0, <=0.10.0.1) potentially affected by CVE-2026-40690 via apache-airflow (2.3.2)

apache-airflow PYPI version 2.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airtel-airflow-plugins 1.5.0 - openmetadata-airflow-managed-apis =0.1.0, =0.10.0.1 Source cves: CVE-2026-40690 Source advisory:...

airtel-airflow-plugins (1.5.0), openmetadata-airflow-managed-apis (>=0.1.0, <=0.10.0.1) potentially affected by CVE-2026-30912 via apache-airflow (2.3.2)

apache-airflow PYPI version 2.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airtel-airflow-plugins 1.5.0 - openmetadata-airflow-managed-apis =0.1.0, =0.10.0.1 Source cves: CVE-2026-30912 Source advisory:...

airtel-airflow-plugins (1.5.0), openmetadata-airflow-managed-apis (>=0.1.0, <=0.10.0.1) potentially affected by CVE-2026-25917 via apache-airflow (2.3.2)

apache-airflow PYPI version 2.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airtel-airflow-plugins 1.5.0 - openmetadata-airflow-managed-apis =0.1.0, =0.10.0.1 Source cves: CVE-2026-25917 Source advisory:...