Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.open-metadata:platform

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.5MavenPublished

    OpenMetadata's Server-Side Template Injection (SSTI) in FreeMarker email templates leads to RCE

    CVE-2026-22244 · GHSA-5f29-2333-h9c7

    Affected
    • Maven org.open-metadata:platform >= 1.5.0, < 1.11.4
    Fixed in
    1.11.4· Vendor fix available
    Issue
    OpenMetadata RCE Vulnerability - Proof of Concept Executive Summary CRITICAL Remote Code Execution vulnerability confirmed in OpenMetadata v1.11.2 via Server-Side Template Injection (SSTI) in FreeMarker email templates. Credit - @lnlinh31, @satthusaosan, @TheMacCuoi, @get-wright, @Ohnooo1234, @hienduc14 – FPT Cloud AppSec Research Team, FPT Smart Cloud Vulnerability Details 1. Root Cause File: openmetadata-service/src/main/java/org/openmetadata/service/util/DefaultTemplateProvider.java Lines 35-45 contain unsafe FreeMarker template instantiation: Missing Security Controls: - ❌ No setNewBuiltinClassResolver(TemplateClassResolver.SAFERRESOLVER) - Allows arbitrary class instantiation - ❌ No setAPIBuiltinEnabled(false) - Enables ?api built-in for reflection - ❌ No input validation - Template content not sanitized 2. Attack Vector (VERIFIED) Step 1: Attacker with Admin role modifies EmailTemplate via PATCH endpoint Step 2: Malicious template stored in MySQL database: Step 3: Trigger…

    Recommended action: Upgrade to 1.11.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →