← Vulnerability feed

Vulnerability record · CVE-2026-26010 · published 11 February 2026

CVE-2026-26010: Open-metadata openmetadata improper privilege management vulnerability

Open Metadata · Openmetadata

OpenMetadata is a unified metadata platform. Prior to 1.11.8, calls issued by the UI against /api/v1/ingestionPipelines leak JWTs used by ingestion-bot for certain services (Glue / Redshift / Postgres). Any read-only user can gain access to a highly privileged account, typically which has the Ingestion Bot Role. This enables destructive changes in OpenMetadata instances, and potential data leakage (e.g. sample data, or service metadata which would be unavailable per roles/policies). This vulnerability is fixed in 1.11.8.

7.6 CVSS 3.1 High EPSS 0.35% · top 73.7% CWE-269 · Improper privilege management
7.6CVSS 3.1 base score
0.35%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 1 tagged exploit
17 Jun 2026Last modified by NVD

Description

OpenMetadata is a unified metadata platform. Prior to 1.11.8, calls issued by the UI against /api/v1/ingestionPipelines leak JWTs used by ingestion-bot for certain services (Glue / Redshift / Postgres). Any read-only user can gain access to a highly privileged account, typically which has the Ingestion Bot Role. This enables destructive changes in OpenMetadata instances, and potential data leakage (e.g. sample data, or service metadata which would be unavailable per roles/policies). This vulnerability is fixed in 1.11.8.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/open-metadata/OpenMetadata/releases/tag/1.11.8-release ProductRelease Notes
https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-pqqf-7hxm-rj5r ExploitVendor Advisory

Track CVE-2026-26010 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2024-28255OpenMetadata JwtFilter authentication bypass via path parametersOpenMetadata's JwtFilter skips JWT validation when a request path matches an excluded endpoint, but path parameters let an attacker make any path con…EPSS 73%analysed8.8CVE-2025-50465Open-metadata openmetadata sql injection vulnerabilityOpenMetadata <=1.4.4 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the TestDefinitio…EPSS 0.32%8.8CVE-2024-55238Open-metadata openmetadata sql injection vulnerabilityOpenMetadata <=1.4.1 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the WorkflowDAO i…EPSS 0.61%8.8CVE-2024-28254OpenMetadata SpEL injection in alert condition validation allows RCEOpenMetadata's AlertUtil::validateExpression evaluates user-supplied SpEL with a StandardEvaluationContext, letting expressions reach Java classes su…EPSS 46%analysed8.8CVE-2024-28847Open-metadata openmetadata code injection vulnerabilityOpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seaml…EPSS 2.4%8.8CVE-2024-28848Open-metadata openmetadata code injection vulnerabilityOpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seaml…EPSS 7.9%8.8CVE-2024-28253Open-metadata openmetadata code injection vulnerabilityOpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seaml…EPSS 13%8.5CVE-2026-22244Open-metadata openmetadata code injection vulnerabilityOpenMetadata is a unified metadata platform. Versions 1.5.0 through 1.11.3 are vulnerable to remote code execution via Server-Side Template Injection…EPSS 1.3%

Source: NIST National Vulnerability Database (record CVE-2026-26010), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.