Lucene search
K
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in
Open-metadataOpenmetadata

12 matches found

CVE
CVE•added 2024/03/15 7:55 p.m.•239 views

CVE-2024-28848

CVE-2024-28848 is a SpEL injection vulnerability in OpenMetadata's GET /api/v1/policies/validation/condition/. The CompiledRule.validateExpression flow evaluates user-supplied SpEL against Java types (e.g., Runtime), enabling remote code execution. The issue is exploitable by authenticated non-ad...

8.8CVSS9.4AI score0.07888EPSS
In wildWeb
CVE
CVE•added 2024/03/15 7:55 p.m.•235 views

CVE-2024-28254

OpenMetadata CVE-2024-28254 is a SpEL injection at GET /api/v1/events/subscriptions/validation/condition/, allowed by AlertUtil::validateExpression, which can reach java.lang.Runtime via StandardEvaluationContext to perform arbitrary commands (RCE). Authentication bypass concerns exist via CVE-20...

8.8CVSS9.7AI score0.45725EPSS
In wild
CVE
CVE•added 2024/03/15 7:55 p.m.•233 views

CVE-2024-28255

OpenMetadata contains a flaw in the JwtFilter authentication check: the code may treat certain requests as excluded endpoints due to path parameters, allowing requests to bypass JWT validation and reach protected endpoints. The issue enables authentication bypass and, in combination with SpEL inj...

9.8CVSS9.8AI score0.73255EPSS
In wild
CVE
CVE•added 2024/03/15 7:55 p.m.•130 views

CVE-2024-28253

OpenMetadata (policy handling) is affected by a SpEL injection in PUT /api/v1/policies. The vulnerability arises because SpEL expressions are evaluated in PolicyRepository.prepare() before authorization checks, allowing an attacker to craft a policy payload that executes arbitrary code via a runt...

9.4CVSS9.7AI score0.12527EPSS
Web
CVE
CVE•added 2024/03/15 7:55 p.m.•114 views

CVE-2024-28847

OpenMetadata contains a SpEL (Spring Expression Language) injection in PUT /api/v1/events/subscriptions. The vulnerability stems from AlertUtil.validateExpression invoked by EventSubscriptionRepository.prepare(), called during EntityRepository.prepareInternal() as part of createOrUpdate flow, all...

8.8CVSS9AI score0.02372EPSS
Web
CVE
CVE•added 2025/04/17 12:0 a.m.•56 views

CVE-2024-55238

OpenMetadata

8.8CVSS7.1AI score0.00531EPSS
CVE
CVE•added 2025/08/08 12:0 a.m.•34 views

CVE-2025-50465

OpenMetadata

8.8CVSS6.5AI score0.00317EPSS
CVE
CVE•added 2025/08/08 12:0 a.m.•29 views

CVE-2025-50466

OpenMetadata (OpenMetadata service)

7.1CVSS6.5AI score0.0032EPSS
CVE
CVE•added 2025/08/08 12:0 a.m.•22 views

CVE-2025-50467

OpenMetadata

6.5CVSS6.5AI score0.00256EPSS
CVE
CVE•added 2025/08/08 12:0 a.m.•22 views

CVE-2025-50468

CVE-2025-50468 affects OpenMetadata

6.5CVSS6.5AI score0.00297EPSS
CVE
CVE•added 2026/02/11 9:5 p.m.•16 views

CVE-2026-26010

OpenMetadata CVE-2026-26010 describes a leakage of JWTs through calls to /api/v1/ingestionPipelines from the UI, prior to version 1.11.8. Read-only users could obtain tokens used by the ingestion-bot for services such as Glue, Redshift, and Postgres, enabling access to a highly privileged Ingesti...

7.6CVSS7.3AI score0.00331EPSS
Web
CVE
CVE•added 2026/01/08 3:12 p.m.•11 views

CVE-2026-22244

OpenMetadata is affected by CVE-2026-22244 due to Server-Side Template Injection (SSTI) in FreeMarker email templates. Affected versions: prior to 1.11.4; exploitation requires administrative privileges and can lead to remote code execution. OpenMetadata 1.11.4 contains a patch. References and Re...

9.4CVSS7.9AI score0.0076EPSS