CVE-2026-26010
📋 TL;DR
OpenMetadata versions before 1.11.8 leak JSON Web Tokens (JWTs) used by the ingestion-bot service through API calls from the UI. This allows any read-only user to gain highly privileged Ingestion Bot Role access, enabling destructive changes and potential data leakage. All OpenMetadata instances running vulnerable versions are affected.
💻 Affected Systems
- OpenMetadata
📦 What is this software?
Openmetadata by Open Metadata
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full administrative control, delete metadata, modify configurations, and exfiltrate sensitive service metadata and sample data from connected databases.
Likely Case
Unauthorized users escalate privileges to perform destructive actions within OpenMetadata, potentially disrupting metadata operations and accessing restricted data.
If Mitigated
With proper network segmentation and access controls, impact is limited to metadata platform disruption without direct database access.
🎯 Exploit Status
Requires read-only user access; exploitation is straightforward once authenticated
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.11.8
Vendor Advisory: https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-pqqf-7hxm-rj5r
Restart Required: Yes
Instructions:
1. Backup your OpenMetadata instance. 2. Upgrade to version 1.11.8 or later. 3. Restart all OpenMetadata services. 4. Verify the fix by checking version and testing API access.
🔧 Temporary Workarounds
Restrict API Access
allLimit access to /api/v1/ingestionPipelines endpoint using network controls or web application firewall rules
Reduce Read-Only Users
allMinimize number of read-only users and review their access permissions
🧯 If You Can't Patch
- Implement strict network segmentation to isolate OpenMetadata from production databases
- Monitor and alert on unusual API calls to ingestionPipelines endpoint
🔍 How to Verify
Check if Vulnerable:
Check OpenMetadata version; if below 1.11.8, the system is vulnerableCheck Version:
Check OpenMetadata UI admin panel or API response for version informationVerify Fix Applied:
Confirm version is 1.11.8 or higher and test that read-only users cannot access privileged ingestion-bot tokens📡 Detection & Monitoring
Log Indicators:
- Unusual API calls to /api/v1/ingestionPipelines from read-only users
- Authentication logs showing privilege escalation
Network Indicators:
- Unexpected outbound connections from OpenMetadata to database services
SIEM Query:
source="openmetadata" AND (uri_path="/api/v1/ingestionPipelines" AND user_role="read-only")