Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.open-metadata:openmetadata-sdk

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.6MavenPublished

    Leaky JWTs in OpenMetadata exposing highly-privileged bot users

    CVE-2026-26010 · GHSA-pqqf-7hxm-rj5r

    Affected
    • Maven org.open-metadata:openmetadata-sdk < 1.11.8
    Fixed in
    1.11.8· Vendor fix available
    Issue
    Calls issued by the UI against /api/v1/ingestionPipelines leak JWTs used by ingestion-bot for certain services (Glue / Redshift / Postgres) Details Any read-only user can gain access to a highly privileged account, typically which has the Ingestion Bot Role. This enables destructive changes in OpenMetadata instances, and potential data leakage (e.g. sample data, or service metadata which would be unavailable per roles/policies). PoC I was able to extract the JWT used by the bot/agent populating sampleathena.default in the Collate Sandbox. To prove this out, I mutated the description to this UUID: fe2e4cc1-da72-4acf-8535-112a3cfa9c7e, which you can see @ https://sandbox.open-metadata.org/database/sampleathena.default. Steps to Reproduce Create a Collate Sandbox account; these are non-admin accounts by default with minimal permissions. Open the Developer Console Go to the Services Page. In this case, sampleathena, though other services In the Network tab, introspect the request…

    Recommended action: Upgrade to 1.11.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →