Advisories · Technology
open-metadata OpenMetadata.
Every CVE that names open-metadata OpenMetadata among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.1 Medium
OpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypass
- open-metadata OpenMetadata
- Server-side request forgery (SSRF)
- CVSS 8.5 High
OpenMetadata before 2.0.0 JWT Disclosure via Unvalidated SAML and OIDC Redirect URI
- open-metadata OpenMetadata
- Open redirect
- CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Authentication Bypass in OpenMetadata
- open-metadata OpenMetadata
- Authentication bypass
- CVSS 8.8 HighCritical · CVSS 7+ and EPSS
SpEL Injection in `GET /api/v1/events/subscriptions/validation/condition/<expr>` in OpenMetadata
- open-metadata OpenMetadata
- Command injection