Open-metadata Openmetadata
13 CVEs affecting Open-metadata Openmetadata. Latest disclosed: 2026-06-08. Critical: 2, High: 9.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-28255 | Critical | 9.8 | 2024-03-15 | OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team c… |
CVE-2024-28253 | Critical | 9.4 | 2024-03-15 | OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team c… |
CVE-2024-28848 | High | 8.8 | 2024-03-15 | OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team c… |
CVE-2024-28847 | High | 8.8 | 2024-03-15 | OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team c… |
CVE-2024-28254 | High | 8.8 | 2024-03-15 | OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team c… |
CVE-2026-46481 | High | 8.3 | 2026-06-08 | OpenMetadata is a unified metadata platform. Prior to version 1.12.4, a non-admin SSO user can trigger a TEST_CONNECTION workflow for a Database Service and re… |
CVE-2026-26010 | High | 7.6 | 2026-02-11 | OpenMetadata is a unified metadata platform. Prior to 1.11.8, calls issued by the UI against /api/v1/ingestionPipelines leak JWTs used by ingestion-bot for cer… |
CVE-2026-22244 | High | 7.2 | 2026-01-08 | OpenMetadata is a unified metadata platform. Versions prior to 1.11.4 are vulnerable to remote code execution via Server-Side Template Injection (SSTI) in Free… |
CVE-2025-50466 | High | 7.1 | 2025-08-08 | OpenMetadata <=1.4.4 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the TestDefinitionDAO inter… |
CVE-2025-50465 | High | 7.1 | 2025-08-08 | OpenMetadata <=1.4.4 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the TestDefinitionDAO inter… |
CVE-2024-55238 | High | 7.1 | 2025-04-17 | OpenMetadata <=1.4.1 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the WorkflowDAO interface… |
CVE-2025-50468 | Medium | 6.5 | 2025-08-08 | OpenMetadata <=1.4.4 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the DocStoreDAO interface… |
CVE-2025-50467 | Medium | 6.5 | 2025-08-08 | OpenMetadata <=1.4.4 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the TestDefinitionDAO inter… |