8 matches found
CVE-2026-100373
OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses. Users permitted to create or update EventSubscription can set webhook destinations to internal...
CVE-2026-100373 OpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypass
OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses. Users permitted to create or update EventSubscription can set webhook destinations to internal...
EUVD-2026-87316
OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses. Users permitted to create or update EventSubscription can set webhook destinations to internal...
CVE-2026-100373
OpenMetadata versions through 2.0.2 are vulnerable to a server-side request forgery (SSRF) vulnerability within the URLValidator.validateURL function. The root cause is a failure to properly resolve DNS hostnames and validate internal addresses. Specifically, users with permissions to create or u...
CVE-2026-100373 OpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypass
OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses. Users permitted to create or update EventSubscription can set webhook destinations to internal...
CVE-2026-100373 OpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypass
OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses. Users permitted to create or update EventSubscription can set webhook destinations to internal...
PT-2026-99101
Name of the Vulnerable Software and Affected Versions OpenMetadata versions prior to 2.0.3 Description An issue exists in the URLValidator.validateURL function where DNS hostnames are not properly resolved and internal addresses are not correctly validated. This allows users with permissions to...
CVE-2026-100373: Server-Side Request Forgery (SSRF)
OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses. Users permitted to create or update EventSubscription can set webhook destinations to internal...