CVE-2026-100373 open-metadata CVE debrief

Who should care

Defenders responsible for OpenMetadata installations, network administrators, and security teams should assess exposure and potential impact. They must verify exposure of OpenMetadata installations to untrusted EventSubscription updates, assess potential impact on private networks, and prioritize remediation based on the specific environment and potential risks.

Why it matters

CVE-2026-100373 allows server-side request forgery in OpenMetadata, enabling probing of private networks and cloud metadata endpoints. Defenders should verify exposure, assess impact, and prioritize remediation.

• Defenders must verify exposure of OpenMetadata installations to untrusted EventSubscription updates.
• Potential probing of private networks and cloud metadata endpoints may occur.
• Remediation priority is uncertain without vendor confirmation.
• Inventory checks and monitoring are necessary to detect potential exploitation.

Technical summary

The URLValidator.validateURL function in OpenMetadata fails to properly resolve DNS hostnames and validate internal addresses, allowing users with EventSubscription permissions to set webhook destinations to internal hosts. This vulnerability enables server-side request forgery, potentially allowing the server to send requests to private networks and cloud metadata endpoints while returning HTTP status codes that enable blind SSRF probing. Affected product deployments should be verified, and defenders should assess the impact on private networks and cloud metadata endpoints.

Defensive priority

Defenders should prioritize verifying exposure of OpenMetadata installations to untrusted EventSubscription updates and assessing potential impact on private networks.

Recommended defensive actions

• Verify OpenMetadata installations for exposure to untrusted EventSubscription updates
• Assess potential impact on private networks and cloud metadata endpoints
• Monitor for suspicious requests to internal hosts
• Update OpenMetadata to a version that addresses the vulnerability, if available
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the server-side request forgery vulnerability in OpenMetadata. However, the corpus does not establish versions beyond 2.0.2, exploitation, impact, or remediation, which require verification from the supplied official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.