CVE-2026-100373
OpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypass
open-metadata OpenMetadata
CVSS
5.1MediumExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 25 Sep 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.26%Chance of exploitation activity in the next 30 days, higher than 17% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses. Users permitted to create or update EventSubscription can set webhook destinations to internal hosts, allowing the server to send requests to private networks and cloud metadata endpoints while returning HTTP status codes that enable blind SSRF probing.
Text from CVE List
Affected versions 1
- OpenMetadataaffected: all versions through 2.0.2CVE List
References 6
- github.com/open-metadata/OpenMetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05fFixvia CVE List
- vulncheck.com/advisories/openmetadata-through-2.0.2-ssrf-via-webhook-url-validation-bypassAdvisoryvia CVE List
- gist.github.com/naif-alfardan/8a69e0648e11b07abe63f949346179c1Exploitvia CVE List
- github.com/open-metadata/OpenMetadata/issues/32592Referencevia CVE List
- github.com/open-metadata/OpenMetadata/blob/2.0.2-release/openmetadata-service/src/main/java/org/openmetadata/service/util/URLValidator.java#L34-L47Referencevia CVE List
- github.com/open-metadata/OpenMetadataReferencevia CVE List