OpenMetadata security vulnerabilities

OpenMetadata is OpenMetadata open source a unified discovery, observable and governance platform powered by a central metadata repository, deep along and seamless team collaboration. A security vulnerability exists in OpenMetadata 1.4.4 and earlier versions, which stems from an unvalidated...

CVE-2025-50465

OpenMetadata =1.4.4 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the TestDefinitionDAO interface. The testPlatform parameter can be used to build a SQL query...

carml (>=21.0.0, <=21.1.0), foliage (>=1.0.1, <=1.5.5) +7 more potentially affected by CVE-2025-47273 via setuptools (58.3.0)

setuptools PYPI version 58.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - carml =21.0.0, =1.0.1, =0.1.0, =0.2.0, =0.0.1, =0.0.4, =0.0.1, =0.0.5 - zowie 1.2.0 Source cves: CVE-2025-47273 Source advisory:...

CVE-2024-55238

OpenMetadata =1.4.1 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the WorkflowDAO interface. The workflowtype and status parameters can be used to build a SQL query...

org.open-metadata:openmetadata-dist (0.12.2-republished) potentially affected by CVE-2024-55238 via org.open-metadata:openmetadata-service (0.12.2-republished)

org.open-metadata:openmetadata-service MAVEN version 0.12.2-republished is affected by a known vulnerability. The following packages have a transitive dependency on org.open-metadata:openmetadata-service and may be impacted: - org.open-metadata:openmetadata-dist 0.12.2-republished Source cves:...

org.open-metadata:openmetadata-dist (0.12.2) potentially affected by CVE-2024-55238 via org.open-metadata:openmetadata-service (0.12.2)

org.open-metadata:openmetadata-service MAVEN version 0.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.open-metadata:openmetadata-service and may be impacted: - org.open-metadata:openmetadata-dist 0.12.2 Source cves: CVE-2024-55238 Source...

org.open-metadata:openmetadata-dist (0.12.1.preview), org.open-metadata:openmetadata-ui (0.12.1.preview) potentially affected by CVE-2024-55238 via org.open-metadata:openmetadata-service (0.12.1.preview)

org.open-metadata:openmetadata-service MAVEN version 0.12.1.preview is affected by a known vulnerability. The following packages have a transitive dependency on org.open-metadata:openmetadata-service and may be impacted: - org.open-metadata:openmetadata-dist 0.12.1.preview -...

GHSA-X8PM-WRG2-MQMX OpenMetadata SQL Injection

OpenMetadata =1.4.1 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the WorkflowDAO interface. The workflowtype and status parameters can be used to build a SQL query...

org.open-metadata:openmetadata-dist (>=1.0.0-alpha, <=1.4.8) potentially affected by CVE-2024-55238 via org.open-metadata:openmetadata-service (>=1.0.0-alpha, <=1.4.8)

org.open-metadata:openmetadata-service MAVEN version =1.0.0-alpha, =1.0.0-alpha, =1.4.8 Source cves: CVE-2024-55238 Source advisory: SNYK:JAVA-ORGOPENMETADATA-9833967...

org.open-metadata:openmetadata-dist (>=1.0.0-alpha, <=1.4.1) potentially affected by CVE-2024-55238 via org.open-metadata:openmetadata-service (>=1.0.0-alpha, <=1.4.1)

org.open-metadata:openmetadata-service MAVEN version =1.0.0-alpha, =1.0.0-alpha, =1.4.1 Source cves: CVE-2024-55238 Source advisory: GHSA-X8PM-WRG2-MQMX...

org.open-metadata:openmetadata-dist (>=1.0.0-alpha, <=1.4.1) potentially affected by CVE-2024-55238 via org.open-metadata:openmetadata-service (>=1.0.0-alpha, <=1.4.1)

org.open-metadata:openmetadata-service MAVEN version =1.0.0-alpha, =1.0.0-alpha, =1.4.1 Source cves: CVE-2024-55238 Source advisory: OSV:GHSA-X8PM-WRG2-MQMX...

org.open-metadata:openmetadata-dist (0.12.1) potentially affected by CVE-2024-55238 via org.open-metadata:openmetadata-service (0.12.1)

org.open-metadata:openmetadata-service MAVEN version 0.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.open-metadata:openmetadata-service and may be impacted: - org.open-metadata:openmetadata-dist 0.12.1 Source cves: CVE-2024-55238 Source...

org.open-metadata:openmetadata-dist (demo_beta1) potentially affected by CVE-2024-55238 via org.open-metadata:openmetadata-service (demo_beta1)

org.open-metadata:openmetadata-service MAVEN version demobeta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.open-metadata:openmetadata-service and may be impacted: - org.open-metadata:openmetadata-dist demobeta1 Source cves: CVE-2024-55238 Sourc...

OpenMetadata SQL Injection

OpenMetadata =1.4.1 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the WorkflowDAO interface. The workflowtype and status parameters can be used to build a SQL query...

org.open-metadata:openmetadata-dist (0.13.2) potentially affected by CVE-2024-55238 via org.open-metadata:openmetadata-service (0.13.2)

org.open-metadata:openmetadata-service MAVEN version 0.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.open-metadata:openmetadata-service and may be impacted: - org.open-metadata:openmetadata-dist 0.13.2 Source cves: CVE-2024-55238 Source...

org.open-metadata:openmetadata-dist (0.13.1) potentially affected by CVE-2024-55238 via org.open-metadata:openmetadata-service (0.13.1)

org.open-metadata:openmetadata-service MAVEN version 0.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.open-metadata:openmetadata-service and may be impacted: - org.open-metadata:openmetadata-dist 0.13.1 Source cves: CVE-2024-55238 Source...

CVE-2024-55238

OpenMetadata =1.4.1 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the WorkflowDAO interface. The workflowtype and status parameters can be used to build a SQL query...

CVE-2024-55238

OpenMetadata =1.4.1 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the WorkflowDAO interface. The workflowtype and status parameters can be used to build a SQL query...

OpenMetadata security vulnerabilities

OpenMetadata is OpenMetadata open source a unified discovery, observable and governance platform powered by a central metadata repository, deep along and seamless team collaboration. A security vulnerability exists in OpenMetadata 1.4.1 and earlier versions that stems from a SQL injection...

PT-2025-17195 · Unknown · Openmetadata

Name of the Vulnerable Software and Affected Versions: OpenMetadata versions 1.4.1 and earlier Description: The issue allows an attacker to extract information from the database. This is achieved through the listCount function in the WorkflowDAO interface, where the workflowtype and status...