← Vulnerability feed

Vulnerability record · CVE-2025-50465 · published 8 August 2025

CVE-2025-50465: Open-metadata openmetadata sql injection vulnerability

Open Metadata · Openmetadata

OpenMetadata <=1.4.4 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the TestDefinitionDAO interface. The testPlatform parameter can be used to build a SQL query.

8.8 CVSS 3.1 High EPSS 0.32% · top 77.0% CWE-89 · SQL injection
8.8CVSS 3.1 base score
0.32%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References
17 Jun 2026Last modified by NVD

Description

OpenMetadata <=1.4.4 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the TestDefinitionDAO interface. The testPlatform parameter can be used to build a SQL query.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://gist.github.com/javadk/c23cc3276f3fb5587b0f4345d7a71a7f Third Party Advisory
https://github.com/open-metadata/OpenMetadata/blob/4b9145a9da7ed95b7f868ab9f351e3d759af47d7/openmetadata-service/src/mai Product
https://github.com/open-metadata/OpenMetadata/blob/4b9145a9da7ed95b7f868ab9f351e3d759af47d7/openmetadata-service/src/mai Product

Track CVE-2025-50465 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2024-28255OpenMetadata JwtFilter authentication bypass via path parametersOpenMetadata's JwtFilter skips JWT validation when a request path matches an excluded endpoint, but path parameters let an attacker make any path con…EPSS 73%analysed8.8CVE-2024-55238Open-metadata openmetadata sql injection vulnerabilityOpenMetadata <=1.4.1 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the WorkflowDAO i…EPSS 0.61%8.8CVE-2024-28254OpenMetadata SpEL injection in alert condition validation allows RCEOpenMetadata's AlertUtil::validateExpression evaluates user-supplied SpEL with a StandardEvaluationContext, letting expressions reach Java classes su…EPSS 46%analysed8.8CVE-2024-28847Open-metadata openmetadata code injection vulnerabilityOpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seaml…EPSS 2.4%8.8CVE-2024-28848Open-metadata openmetadata code injection vulnerabilityOpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seaml…EPSS 7.9%8.8CVE-2024-28253Open-metadata openmetadata code injection vulnerabilityOpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seaml…EPSS 13%8.5CVE-2026-22244Open-metadata openmetadata code injection vulnerabilityOpenMetadata is a unified metadata platform. Versions 1.5.0 through 1.11.3 are vulnerable to remote code execution via Server-Side Template Injection…EPSS 1.3%7.6CVE-2026-26010Open-metadata openmetadata improper privilege management vulnerabilityOpenMetadata is a unified metadata platform. Prior to 1.11.8, calls issued by the UI against /api/v1/ingestionPipelines leak JWTs used by ingestion-b…EPSS 0.35%

Source: NIST National Vulnerability Database (record CVE-2025-50465), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.