← Vulnerability feed

Vulnerability record · CVE-2026-22244 · published 8 January 2026

CVE-2026-22244: Open-metadata openmetadata code injection vulnerability

Open Metadata · Openmetadata

OpenMetadata is a unified metadata platform. Versions 1.5.0 through 1.11.3 are vulnerable to remote code execution via Server-Side Template Injection (SSTI) in FreeMarker email templates. An attacker must have administrative privileges to exploit the vulnerability. Version 1.11.4 contains a patch.

8.5 CVSS 4.0 High EPSS 1.3% · top 30.6% CWE-1336 · CWE-1336CWE-94 · Code injection
8.5CVSS 4.0 base score
1.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 2 tagged exploit
31 Aug 2026Last modified by NVD

Description

OpenMetadata is a unified metadata platform. Versions 1.5.0 through 1.11.3 are vulnerable to remote code execution via Server-Side Template Injection (SSTI) in FreeMarker email templates. An attacker must have administrative privileges to exploit the vulnerability. Version 1.11.4 contains a patch.

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/open-metadata/OpenMetadata/commit/bffe7c45807763f9b682021d4211c478d2a08bb3 Patch
https://github.com/open-metadata/OpenMetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108
https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-5f29-2333-h9c7 ExploitVendor Advisory
https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-5f29-2333-h9c7 ExploitVendor Advisory

Track CVE-2026-22244 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2024-28255OpenMetadata JwtFilter authentication bypass via path parametersOpenMetadata's JwtFilter skips JWT validation when a request path matches an excluded endpoint, but path parameters let an attacker make any path con…EPSS 73%analysed8.8CVE-2025-50465Open-metadata openmetadata sql injection vulnerabilityOpenMetadata <=1.4.4 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the TestDefinitio…EPSS 0.32%8.8CVE-2024-55238Open-metadata openmetadata sql injection vulnerabilityOpenMetadata <=1.4.1 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the WorkflowDAO i…EPSS 0.61%8.8CVE-2024-28254OpenMetadata SpEL injection in alert condition validation allows RCEOpenMetadata's AlertUtil::validateExpression evaluates user-supplied SpEL with a StandardEvaluationContext, letting expressions reach Java classes su…EPSS 46%analysed8.8CVE-2024-28847Open-metadata openmetadata code injection vulnerabilityOpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seaml…EPSS 2.4%8.8CVE-2024-28848Open-metadata openmetadata code injection vulnerabilityOpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seaml…EPSS 7.9%8.8CVE-2024-28253Open-metadata openmetadata code injection vulnerabilityOpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seaml…EPSS 13%7.6CVE-2026-26010Open-metadata openmetadata improper privilege management vulnerabilityOpenMetadata is a unified metadata platform. Prior to 1.11.8, calls issued by the UI against /api/v1/ingestionPipelines leak JWTs used by ingestion-b…EPSS 0.35%

Source: NIST National Vulnerability Database (record CVE-2026-22244), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.