CVE-2026-81029 open-metadata CVE debrief

Who should care

OpenMetadata users and administrators should assess exposure and take action to prevent account takeover. This vulnerability requires verification from the supplied official sources, and its impact and remediation are limited by the available evidence.

Why it matters

CVE-2026-81029 is a high-severity vulnerability in OpenMetadata that allows for post-authentication token disclosure. OpenMetadata users and administrators should assess exposure and take action to prevent account takeover. The vulnerability requires verification from the supplied official sources, and its impact and remediation are limited by the available evidence.

• Account takeover via crafted redirect links
• Potential for unauthorized API access
• Need for verification of OpenMetadata version and exposure
• Priority for upgrading to version 2.0.0 or later

Technical summary

The OpenMetadata application is vulnerable to a post-authentication token disclosure issue. The SamlLoginServlet and OIDC/OAuth2 handlers accept a caller-supplied redirect target and append the issued token to it. This allows an attacker to craft a link that, when followed by a user, will disclose a valid token for the account that completed the login. The vulnerability is particularly severe because it enables an attacker to gain control of a user's account, potentially leading to unauthorized API access. OpenMetadata users and administrators should assess exposure and take action to prevent account takeover by upgrading to version 2.0.0 or later.

Defensive priority

High priority for OpenMetadata users and administrators to assess exposure and upgrade to version 2.0.0 or later.

Recommended defensive actions

• Assess exposure by checking if OpenMetadata is in use and if the version is prior to 2.0.0.
• Upgrade to OpenMetadata version 2.0.0 or later to remove the caller-supplied callback parameter vulnerability.
• Monitor for suspicious login activity and implement compensating controls to prevent account takeover.
• Verify the authenticity of login requests and redirect targets.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including a CVSS score of 8.5 and a HIGH severity rating. The vulnerability is described as a post-authentication token disclosure issue.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.