CVE-2024-55238 OpenMetadata SQL Injection

What is CVE-2024-55238?

CVE-2024-55238 is a high-severity SQL injection vulnerability in n/a, published on 17 Apr 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

OpenMetadata <=1.4.1 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the WorkflowDAO interface. The workflowtype and status parameters can be used to build a SQL query.

Weakness: CWE-89

Which versions are affected by CVE-2024-55238?

2 open source packages ship an affected version, including org.open-metadata:openmetadata-service. It affects 1 product.

Products include Open-Metadata Openmetadata.

How do I fix CVE-2024-55238?

No fix has been published for CVE-2024-55238 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2024-55238 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-55238 exists.

Other vulnerabilities in n/a

• CVE-2024-28255 Authentication Bypass in OpenMetadata Critical 9.8
• CVE-2024-28253 SpEL Injection in `PUT /api/v1/policies` in OpenMetadata Critical 9.4
• CVE-2024-28254 SpEL Injection in `GET /api/v1/events/subscriptions/validation/condition/<expr>` in OpenMetadata High 8.8
• CVE-2024-28847 SpEL Injection in `PUT /api/v1/events/subscriptions` in OpenMetadata High 8.8
• CVE-2024-28848 SpEL Injection in `GET /api/v1/policies/validation/condition/<expr>` in OpenMetadata High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-x8pm-wrg2-mqmx.