PT-2026-42663 · Open Metadata+2 · Openmetadata+1

CVE-2026-46481 · Published 2026-05-21 · Updated 2026-06-08

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions OpenMetadata versions prior to 1.12.4

Description A non-admin SSO user can trigger a TEST CONNECTION workflow for a Database Service and receive sensitive information in the HTTP 201 response of the 'POST /api/v1/automations/workflows' endpoint. The response leaks the cleartext database password via the request.connection.config.password variable and the ingestion bot JSON Web Token (JWT) through the openMetadataServerConnection.securityConfig.jwtToken variable. A JWT is a compact, URL-safe means of representing claims to be transferred between two parties. The leaked ingestion-bot token can be reused in the Authorization header to access sensitive service APIs, such as 'GET /api/v1/services/databaseServices/{id}', with bot-level privileges.

Recommendations Update to version 1.12.4. Configure the Secrets Store to store credentials to prevent cleartext password exposure. Restrict access to the 'POST /api/v1/automations/workflows' endpoint for non-admin users to minimize the risk of token and credential leakage.

Exploit

Fix

Weakness Enumeration

CWE-201

Related Identifiers

CVE-2026-46481

GHSA-9VMH-WHC4-7PHG

Affected Products

Openmetadata

Org.Open-Metadata:Openmetadata-Service

References · 7

• 🔥 https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-9vmh-whc4-7phg · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46481.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-46481 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9vmh-whc4-7phg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-46481 · Security Note
• https://github.com/open-metadata/OpenMetadata · Note
• https://t.me/CVEtracker/56188 · Telegram Post