airtel-airflow-plugins (1.5.0), openmetadata-airflow-managed-apis (>=0.1.0, <=0.10.0.1) potentially affected by CVE-2026-42358 via apache-airflow (2.3.2)

apache-airflow PYPI version 2.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airtel-airflow-plugins 1.5.0 - openmetadata-airflow-managed-apis =0.1.0, =0.10.0.1 Source cves: CVE-2026-42358 Source advisory:...

airtel-airflow-plugins (1.5.0), openmetadata-airflow-managed-apis (>=0.1.0, <=0.10.0.1) potentially affected by CVE-2026-42360 via apache-airflow (2.3.2)

apache-airflow PYPI version 2.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airtel-airflow-plugins 1.5.0 - openmetadata-airflow-managed-apis =0.1.0, =0.10.0.1 Source cves: CVE-2026-42360 Source advisory:...

airtel-airflow-plugins (1.5.0), openmetadata-airflow-managed-apis (>=0.1.0, <=0.10.0.1) potentially affected by CVE-2026-40961 via apache-airflow (2.3.2)

apache-airflow PYPI version 2.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airtel-airflow-plugins 1.5.0 - openmetadata-airflow-managed-apis =0.1.0, =0.10.0.1 Source cves: CVE-2026-40961 Source advisory:...

airtel-airflow-plugins (1.5.0), openmetadata-airflow-managed-apis (>=0.1.0, <=0.10.0.1) potentially affected by CVE-2026-40861 via apache-airflow (2.3.2)

apache-airflow PYPI version 2.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airtel-airflow-plugins 1.5.0 - openmetadata-airflow-managed-apis =0.1.0, =0.10.0.1 Source cves: CVE-2026-40861 Source advisory:...

airtel-airflow-plugins (1.5.0), openmetadata-airflow-managed-apis (>=0.1.0, <=0.10.0.1) potentially affected by CVE-2026-45192 via apache-airflow (2.3.2)

apache-airflow PYPI version 2.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airtel-airflow-plugins 1.5.0 - openmetadata-airflow-managed-apis =0.1.0, =0.10.0.1 Source cves: CVE-2026-45192 Source advisory:...

airtel-airflow-plugins (1.5.0), openmetadata-airflow-managed-apis (>=0.1.0, <=0.10.0.1) potentially affected by CVE-2026-48726 via apache-airflow (2.3.2)

apache-airflow PYPI version 2.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airtel-airflow-plugins 1.5.0 - openmetadata-airflow-managed-apis =0.1.0, =0.10.0.1 Source cves: CVE-2026-48726 Source advisory:...

airtel-airflow-plugins (1.5.0), openmetadata-airflow-managed-apis (>=0.1.0, <=0.10.0.1) potentially affected by CVE-2026-42360 via apache-airflow (2.3.2)

apache-airflow PYPI version 2.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airtel-airflow-plugins 1.5.0 - openmetadata-airflow-managed-apis =0.1.0, =0.10.0.1 Source cves: CVE-2026-42360 Source advisory:...

airtel-airflow-plugins (1.5.0), openmetadata-airflow-managed-apis (>=0.1.0, <=0.10.0.1) potentially affected by CVE-2026-45360 via apache-airflow (2.3.2)

apache-airflow PYPI version 2.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airtel-airflow-plugins 1.5.0 - openmetadata-airflow-managed-apis =0.1.0, =0.10.0.1 Source cves: CVE-2026-45360 Source advisory:...

airtel-airflow-plugins (1.5.0), openmetadata-airflow-managed-apis (>=0.1.0, <=0.10.0.1) potentially affected by CVE-2026-40861 via apache-airflow (2.3.2)

apache-airflow PYPI version 2.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airtel-airflow-plugins 1.5.0 - openmetadata-airflow-managed-apis =0.1.0, =0.10.0.1 Source cves: CVE-2026-40861 Source advisory:...

airtel-airflow-plugins (1.5.0), openmetadata-airflow-managed-apis (>=0.1.0, <=0.10.0.1) potentially affected by CVE-2026-45192 via apache-airflow (2.3.2)

apache-airflow PYPI version 2.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airtel-airflow-plugins 1.5.0 - openmetadata-airflow-managed-apis =0.1.0, =0.10.0.1 Source cves: CVE-2026-45192 Source advisory:...

org.open-metadata:openmetadata-dist (>=1.0.0-alpha, <=1.12.3), org.open-metadata:openmetadata-k8s-operator (>=1.12.0-rc1, <=1.12.3) +1 more potentially affected by CVE-2026-46481 via org.open-metadata:openmetadata-service (>=1.0.0-alpha, <=1.12.3)

org.open-metadata:openmetadata-service MAVEN version =1.0.0-alpha, =1.0.0-alpha, =1.12.0-rc1, =1.9.0, =1.12.3 Source cves: CVE-2026-46481 Source advisory: OSV:GHSA-9VMH-WHC4-7PHG...

org.open-metadata:openmetadata-dist (0.13.2-beta) potentially affected by CVE-2026-46481 via org.open-metadata:openmetadata-service (0.13.2-beta)

org.open-metadata:openmetadata-service MAVEN version 0.13.2-beta is affected by a known vulnerability. The following packages have a transitive dependency on org.open-metadata:openmetadata-service and may be impacted: - org.open-metadata:openmetadata-dist 0.13.2-beta Source cves: CVE-2026-46481...

org.open-metadata:openmetadata-dist (0.13.1) potentially affected by CVE-2026-46481 via org.open-metadata:openmetadata-service (0.13.1)

org.open-metadata:openmetadata-service MAVEN version 0.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.open-metadata:openmetadata-service and may be impacted: - org.open-metadata:openmetadata-dist 0.13.1 Source cves: CVE-2026-46481 Source...

org.open-metadata:openmetadata-dist (0.12.2) potentially affected by CVE-2026-46481 via org.open-metadata:openmetadata-service (0.12.2)

org.open-metadata:openmetadata-service MAVEN version 0.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.open-metadata:openmetadata-service and may be impacted: - org.open-metadata:openmetadata-dist 0.12.2 Source cves: CVE-2026-46481 Source...

org.open-metadata:openmetadata-dist (0.12.1.preview), org.open-metadata:openmetadata-ui (0.12.1.preview) potentially affected by CVE-2026-46481 via org.open-metadata:openmetadata-service (0.12.1.preview)

org.open-metadata:openmetadata-service MAVEN version 0.12.1.preview is affected by a known vulnerability. The following packages have a transitive dependency on org.open-metadata:openmetadata-service and may be impacted: - org.open-metadata:openmetadata-dist 0.12.1.preview -...

org.open-metadata:openmetadata-dist (0.13.2) potentially affected by CVE-2026-46481 via org.open-metadata:openmetadata-service (0.13.2)

org.open-metadata:openmetadata-service MAVEN version 0.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.open-metadata:openmetadata-service and may be impacted: - org.open-metadata:openmetadata-dist 0.13.2 Source cves: CVE-2026-46481 Source...

Insertion of Sensitive Information Into Sent Data

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the TESTCONNECTION workflow for a Database Service. An attacker can obtain sensitive credentials and authentication tokens by triggering the workflow and inspecting the HTTP response...

org.open-metadata:openmetadata-dist (>=1.0.0-alpha, <=1.12.3), org.open-metadata:openmetadata-k8s-operator (>=1.12.0-rc1, <=1.12.3) +1 more potentially affected by CVE-2026-46481 via org.open-metadata:openmetadata-service (>=1.0.0-alpha, <=1.12.3)

org.open-metadata:openmetadata-service MAVEN version =1.0.0-alpha, =1.0.0-alpha, =1.12.0-rc1, =1.9.0, =1.12.3 Source cves: CVE-2026-46481 Source advisory: GHSA-9VMH-WHC4-7PHG...

org.open-metadata:openmetadata-dist (>=1.12.1, <=1.12.3), org.open-metadata:openmetadata-k8s-operator (>=1.12.1, <=1.12.3) +1 more potentially affected by CVE-2026-46481 via org.open-metadata:openmetadata-service (>=1.12.1, <=1.12.3)

org.open-metadata:openmetadata-service MAVEN version =1.12.1, =1.12.1, =1.12.1, =1.12.1, =1.12.3 Source cves: CVE-2026-46481 Source advisory: SNYK:JAVA-ORGOPENMETADATA-16874299...

OpenMetadata: TEST_CONNECTION workflow leaks ingestion-bot JWT and database password to regular users

This is not applicable if an application is configuring the Secrets Store to store credentials. Please make sure to follow the best practices when deploying in production In OpenMetadata 1.12.1, a non-admin SSO user can trigger a TESTCONNECTION workflow for a Database Service and receive, in the...