CVE-2026-100373Published
OpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypass
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-100373 · Microsoft / collected KEV context
cve-program · CVE-2026-100373
- https://gist.github.com/naif-alfardan/8a69e0648e11b07abe63f949346179c1
- https://github.com/open-metadata/OpenMetadata/issues/32592
- https://github.com/open-metadata/OpenMetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f
- https://github.com/open-metadata/OpenMetadata/blob/2.0.2-release/openmetadata-service/src/main/java/org/openmetadata/service/util/URLValidator.java#L34-L47
- https://github.com/open-metadata/OpenMetadata
- https://www.vulncheck.com/advisories/openmetadata-through-2.0.2-ssrf-via-webhook-url-validation-bypass
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.