CVE-2026-22244
📋 TL;DR
OpenMetadata versions before 1.11.4 contain a Server-Side Template Injection vulnerability in FreeMarker email templates that allows remote code execution. Attackers with administrative privileges can exploit this to execute arbitrary code on affected systems. This affects all deployments running vulnerable OpenMetadata versions.
💻 Affected Systems
- OpenMetadata
📦 What is this software?
Openmetadata by Open Metadata
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining complete control over the OpenMetadata server, potentially leading to data theft, lateral movement, or deployment of persistent backdoors.
Likely Case
Privileged attacker executes arbitrary commands to steal sensitive metadata, modify configurations, or disrupt service availability.
If Mitigated
Limited impact due to administrative privilege requirement and proper access controls, potentially only affecting the OpenMetadata application itself.
🎯 Exploit Status
Exploitation requires administrative access but is straightforward once authenticated. No public exploit code has been identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.11.4
Vendor Advisory: https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-5f29-2333-h9c7
Restart Required: Yes
Instructions:
1. Backup your OpenMetadata configuration and data. 2. Stop the OpenMetadata service. 3. Upgrade to version 1.11.4 or later. 4. Restart the service. 5. Verify the upgrade was successful.
🔧 Temporary Workarounds
Restrict Administrative Access
allLimit administrative accounts to only trusted users and implement strong authentication controls.
Network Segmentation
allIsolate OpenMetadata servers from sensitive networks and implement strict firewall rules.
🧯 If You Can't Patch
- Implement strict access controls and monitor all administrative activity
- Deploy network-based intrusion detection systems to monitor for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check OpenMetadata version via web interface or configuration files. Versions below 1.11.4 are vulnerable.Check Version:
Check OpenMetadata UI or configuration files for version informationVerify Fix Applied:
Confirm version is 1.11.4 or higher and test email template functionality to ensure no unexpected behavior.📡 Detection & Monitoring
Log Indicators:
- Unusual administrative login patterns
- Suspicious FreeMarker template processing errors
- Unexpected system command execution
Network Indicators:
- Unusual outbound connections from OpenMetadata server
- Suspicious payloads in HTTP requests to template endpoints
SIEM Query:
source="openmetadata" AND (event="template_processing" OR event="admin_login") AND status="error"