CVE-2026-100373
OpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypass
CVSS Score
4.1
EPSS Score
0.0%
EPSS Percentile
0th
OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses. Users permitted to create or update EventSubscription can set webhook destinations to internal hosts, allowing the server to send requests to private networks and cloud metadata endpoints while returning HTTP status codes that enable blind SSRF probing.
| CWE | CWE-918 |
| Vendor | open-metadata |
| Product | openmetadata |
| Published | Sep 25, 2026 |
| Last Updated | Sep 25, 2026 |
Stay Ahead of the Next One
Get instant alerts for open-metadata openmetadata
Be the first to know when new medium vulnerabilities affecting open-metadata openmetadata are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
open-metadata / OpenMetadata
0 ≤ 2.0.2
References
gist.github.com: https://gist.github.com/naif-alfardan/8a69e0648e11b07abe63f949346179c1 github.com: https://github.com/open-metadata/OpenMetadata/issues/32592 github.com: https://github.com/open-metadata/OpenMetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f github.com: https://github.com/open-metadata/OpenMetadata/blob/2.0.2-release/openmetadata-service/src/main/java/org/openmetadata/service/util/URLValidator.java#L34-L47 github.com: https://github.com/open-metadata/OpenMetadata vulncheck.com: https://www.vulncheck.com/advisories/openmetadata-through-2.0.2-ssrf-via-webhook-url-validation-bypass
Credits
Naif Al-fardan