CVE-2026-26010 Leaky JWTs in OpenMetadata exposing highly-privileged bot users
Read-only users can steal privileged JWTs from API responses to gain Ingestion Bot role, enabling destructive changes and data leakage.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-26010?
CVE-2026-26010 is a high-severity vulnerability in open-metadata OpenMetadata, published on 11 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
OpenMetadata is a unified metadata platform. Prior to 1.11.8, calls issued by the UI against /api/v1/ingestionPipelines leak JWTs used by ingestion-bot for certain services (Glue / Redshift / Postgres). Any read-only user can gain access to a highly privileged account, typically which has the Ingestion Bot Role. This enables destructive changes in OpenMetadata instances, and potential data leakage (e.g. sample data, or service metadata which would be unavailable per roles/policies). This vulnerability is fixed in 1.11.8.
Weakness: CWE-269
Which versions are affected by CVE-2026-26010?
2 open source packages ship an affected version, including org.open-metadata:openmetadata-sdk. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.open-metadata:openmetadata-sdk Maven | All versions | 1.11.8 |
org.open-metadata:openmetadata-sdk Maven | All versions | 1.11.8 |
Products include Open-Metadata Openmetadata.
How do I fix CVE-2026-26010?
Upgrade org.open-metadata:openmetadata-sdk to 1.11.8 or later.
Is CVE-2026-26010 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-26010 exists.
Other vulnerabilities in open-metadata OpenMetadata
- CVE-2024-28255 Authentication Bypass in OpenMetadata
- CVE-2024-28253 SpEL Injection in `PUT /api/v1/policies` in OpenMetadata
- CVE-2024-28254 SpEL Injection in `GET /api/v1/events/subscriptions/validation/condition/<expr>` in OpenMetadata
- CVE-2024-28847 SpEL Injection in `PUT /api/v1/events/subscriptions` in OpenMetadata
- CVE-2024-28848 SpEL Injection in `GET /api/v1/policies/validation/condition/<expr>` in OpenMetadata
Sources
Also known as GHSA-pqqf-7hxm-rj5r.