CVE-2026-100373 json
OpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypass
published 2026-09-25 44 d ago modified 2026-09-25 44 d ago also EUVD-2026-87316
- cvss
- 4.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 18%
- public exploits
- 0
- none known
Summary
OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses. Users permitted to create or update EventSubscription can set webhook destinations to internal hosts, allowing the server to send requests to private networks and cloud metadata endpoints while returning HTTP status codes that enable blind SSRF probing.
Patch / fix
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 44 d ago
Exploit prediction
0.26% chance of exploitation in the next 30 days, higher than 18% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- gist.github.com https://gist.github.com/naif-alfardan/8a69e0648e11b07abe63f949346179c1 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N |
| CNA | 3.1 | 4.1 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N |
| CNA | 4.0 | 5.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- open-metadata OpenMetadata
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
-
github.com
/open-metadata/OpenMetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f
patch
-
gist.github.com
/naif-alfardan/8a69e0648e11b07abe63f949346179c1
exploit, third-party-advisory
-
github.com
/open-metadata/OpenMetadata/issues/32592
issue-tracking
-
github.com
/open-metadata/OpenMetadata/blob/2.0.2-release/openmetadata-service/src/main/java/org/openmetadata/service/uti
technical-description
-
github.com
/open-metadata/OpenMetadata
product
-
vulncheck.com
/advisories/openmetadata-through-2.0.2-ssrf-via-webhook-url-validation-bypass
third-party-advisory
Sources
- CVE List CVE-2026-100373
- NVD CVE-2026-100373
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.