org.open-metadata:openmetadata-dist (>=demo_beta1, <=1.12.3), org.open-metadata:openmetadata-k8s-operator (>=1.12.0-rc1, <=1.12.3) +2 more potentially affected by CVE-2026-46481 via org.open-metadata:openmetadata-service (>=demo_beta1, <=1.12.3)

org.open-metadata:openmetadata-service MAVEN version =demobeta1, =demobeta1, =1.12.0-rc1, =1.9.0, =1.12.3 - org.open-metadata:openmetadata-ui 0.12.1.preview Source cves: CVE-2026-46481 Source advisory: MEND:CVE-2026-46481...

org.open-metadata:openmetadata-dist (>=1.0.0-alpha, <=1.12.3), org.open-metadata:openmetadata-k8s-operator (>=1.12.0-rc1, <=1.12.3) +1 more potentially affected by CVE-2026-46481 via org.open-metadata:openmetadata-service (>=1.0.0-alpha, <=1.12.3)

org.open-metadata:openmetadata-service MAVEN version =1.0.0-alpha, =1.0.0-alpha, =1.12.0-rc1, =1.9.0, =1.12.3 Source cves: CVE-2026-46481 Source advisory: OSV:GHSA-9VMH-WHC4-7PHG...

org.open-metadata:openmetadata-dist (0.13.2) potentially affected by CVE-2026-46481 via org.open-metadata:openmetadata-service (0.13.2)

org.open-metadata:openmetadata-service MAVEN version 0.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.open-metadata:openmetadata-service and may be impacted: - org.open-metadata:openmetadata-dist 0.13.2 Source cves: CVE-2026-46481 Source...

org.open-metadata:openmetadata-dist (0.13.2-beta) potentially affected by CVE-2026-46481 via org.open-metadata:openmetadata-service (0.13.2-beta)

org.open-metadata:openmetadata-service MAVEN version 0.13.2-beta is affected by a known vulnerability. The following packages have a transitive dependency on org.open-metadata:openmetadata-service and may be impacted: - org.open-metadata:openmetadata-dist 0.13.2-beta Source cves: CVE-2026-46481...

org.open-metadata:openmetadata-dist (0.13.1) potentially affected by CVE-2026-46481 via org.open-metadata:openmetadata-service (0.13.1)

org.open-metadata:openmetadata-service MAVEN version 0.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.open-metadata:openmetadata-service and may be impacted: - org.open-metadata:openmetadata-dist 0.13.1 Source cves: CVE-2026-46481 Source...

org.open-metadata:openmetadata-dist (0.12.2) potentially affected by CVE-2026-46481 via org.open-metadata:openmetadata-service (0.12.2)

org.open-metadata:openmetadata-service MAVEN version 0.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.open-metadata:openmetadata-service and may be impacted: - org.open-metadata:openmetadata-dist 0.12.2 Source cves: CVE-2026-46481 Source...

org.open-metadata:openmetadata-dist (0.12.1.preview), org.open-metadata:openmetadata-ui (0.12.1.preview) potentially affected by CVE-2026-46481 via org.open-metadata:openmetadata-service (0.12.1.preview)

org.open-metadata:openmetadata-service MAVEN version 0.12.1.preview is affected by a known vulnerability. The following packages have a transitive dependency on org.open-metadata:openmetadata-service and may be impacted: - org.open-metadata:openmetadata-dist 0.12.1.preview -...

Insertion of Sensitive Information Into Sent Data

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the TESTCONNECTION workflow for a Database Service. An attacker can obtain sensitive credentials and authentication tokens by triggering the workflow and inspecting the HTTP response...

org.open-metadata:openmetadata-dist (>=1.0.0-alpha, <=1.12.3), org.open-metadata:openmetadata-k8s-operator (>=1.12.0-rc1, <=1.12.3) +1 more potentially affected by CVE-2026-46481 via org.open-metadata:openmetadata-service (>=1.0.0-alpha, <=1.12.3)

org.open-metadata:openmetadata-service MAVEN version =1.0.0-alpha, =1.0.0-alpha, =1.12.0-rc1, =1.9.0, =1.12.3 Source cves: CVE-2026-46481 Source advisory: GHSA-9VMH-WHC4-7PHG...

org.open-metadata:openmetadata-dist (>=1.12.1, <=1.12.3), org.open-metadata:openmetadata-k8s-operator (>=1.12.1, <=1.12.3) +1 more potentially affected by CVE-2026-46481 via org.open-metadata:openmetadata-service (>=1.12.1, <=1.12.3)

org.open-metadata:openmetadata-service MAVEN version =1.12.1, =1.12.1, =1.12.1, =1.12.1, =1.12.3 Source cves: CVE-2026-46481 Source advisory: SNYK:JAVA-ORGOPENMETADATA-16874299...

org.open-metadata:openmetadata-dist (demo_beta1) potentially affected by CVE-2026-46481 via org.open-metadata:openmetadata-service (demo_beta1)

org.open-metadata:openmetadata-service MAVEN version demobeta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.open-metadata:openmetadata-service and may be impacted: - org.open-metadata:openmetadata-dist demobeta1 Source cves: CVE-2026-46481 Sourc...

org.open-metadata:openmetadata-dist (0.12.1) potentially affected by CVE-2026-46481 via org.open-metadata:openmetadata-service (0.12.1)

org.open-metadata:openmetadata-service MAVEN version 0.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.open-metadata:openmetadata-service and may be impacted: - org.open-metadata:openmetadata-dist 0.12.1 Source cves: CVE-2026-46481 Source...

Insertion of Sensitive Information Into Sent Data

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the api/v1/ingestionPipelines endpoint, which exposes JWT tokens used by privileged bot accounts in API responses. An attacker can gain unauthorized access to sensitive data and...

org.open-metadata:openmetadata-dist (>=0.12.1, <=1.11.3), org.open-metadata:openmetadata-mcp (>=1.9.0, <=1.11.3) +1 more potentially affected by CVE-2026-22244 via org.open-metadata:openmetadata-service (>=0.12.1, <=1.11.3)

org.open-metadata:openmetadata-service MAVEN version =0.12.1, =0.12.1, =1.9.0, =1.11.3 - org.open-metadata:openmetadata-ui 0.12.1.preview Source cves: CVE-2026-22244 Source advisory: MEND:CVE-2026-22244...

org.open-metadata:openmetadata-dist (>=1.0.0-alpha, <=1.11.3), org.open-metadata:openmetadata-mcp (>=1.9.0, <=1.11.3) potentially affected by unknown CVE via org.open-metadata:openmetadata-service (>=1.0.0-alpha, <=1.11.3)

org.open-metadata:openmetadata-service MAVEN version =1.0.0-alpha, =1.0.0-alpha, =1.9.0, =1.11.3 Source cves: unknown CVE Source advisory: SNYK:JAVA-ORGOPENMETADATA-14912636...

SQL Injection

org.open-metadata, openmetadata-service is vulnerable to SQL injection. The vulnerability is due to improper input sanitization in the listCount function of the TestDefinitionDAO interface, where the testPlatform parameter is directly used to construct a SQL query, allowing attackers to inject...

SQL Injection

org.open-metadata, openmetadata-service is vulnerable to SQL Injection. The vulnerability is due to improper handling of the entityType parameter in TestDefinitionDAO.listCount due to concatenating untrusted input into an SQL query, allowing attackers to supply crafted entityType values that modi...

SQL Injection

org.open-metadata, openmetadata-service is vulnerable to SQL Injection. The vulnerability is due to improper handling of the supportedDataTypeParam parameter in TestDefinitionDAO.listCount due to concatenating untrusted input into an SQL query, allowing attackers to supply crafted...

org.open-metadata:openmetadata-dist (>=1.0.0-alpha, <=1.4.4) potentially affected by CVE-2025-50465 via org.open-metadata:openmetadata-service (>=1.0.0-alpha, <=1.4.4)

org.open-metadata:openmetadata-service MAVEN version =1.0.0-alpha, =1.0.0-alpha, =1.4.4 Source cves: CVE-2025-50465 Source advisory: SNYK:JAVA-ORGOPENMETADATA-12009019...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the listCount function in the TestDefinitionDAO interface when the testPlatform parameter is used to construct a SQL query. An attacker can extract sensitive information from the database by injecting crafted input int...