Vulnerability in Open-metadata Openmetadata

CVE-2026-22244

OpenMetadata is a unified metadata platform. Versions prior to 1.11.4 are vulnerable to remote code execution via Server-Side Template Injection (SSTI) in FreeMarker email templates. An attacker must have administrative privileges to explo…

EPSS: 0.006 (70.5th percentile) — read the EPSS interpretation.

Affected products

Open-metadata Openmetadata — versions < 1.11.4

Weakness classification (CWE)

CWE-1336 — Improper Neutralization of Special Elements Used in a Template Engine

References

https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-5f29-2333-h9c7 (x_refsource_CONFIRM)
https://github.com/open-metadata/OpenMetadata/commit/bffe7c45807763f9b682021d4211c478d2a08bb3 (x_refsource_MISC)