Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
OpenMetadata is a unified metadata platform. Prior to 1.11.8, calls issued by the UI against /api/v1/ingestionPipelines leak JWTs used by ingestion-bot for certain services (Glue / Redshift / Postgres). Any read-only user can gain access to a highly privileged account, typically which has the Ingestion Bot Role. This enables destructive changes in OpenMetadata instances, and potential data leakage (e.g. sample data, or service metadata which would be unavailable per roles/policies). This vulnerability is fixed in 1.11.8.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-11 | 1 | Disclosure1 |
| 2026-02-12 | 1 | Disclosure1 |
| 2026-02-17 | 1 | PoC1 |
CVE-2026-26010 OpenMetadata is a unified metadata platform. Prior to 1.11.8, calls issued by the UI against /api/v1/ingestionPipelines leak JWTs used by ingestion-bot for certain se… https://www.cve.org/CVERecord?id=CVE-2026-26010
Post summary
CVE-2026-26010 exposes a JWT leakage in OpenMetadata UI API calls for versions before 1.11.8, potentially exposing authentication tokens.
csirt_it: ‼️#OpenMetadata: disponibile un #PoC per lo sfruttamento della CVE-2026-26010 Rischio:🟠 Tipologia: 🔸Information Disclosure 🔸Privilege escalation 🔗https://www.acn.gov.it/portale/en/csirt-italia/alert-e-bollettini?tipologia=39682 ⚠ Ove non provveduto, si raccomanda l’aggiornamento del software… https://t.co/Qwy0x3Ds1E
Post summary
A Proof of Concept for CVE-2026-26010 is available and the alert recommends updating the software; no evidence of active exploitation or detailed exploit code is provided.
CVE-2026-26010: OpenMetadata's Open Kimono: CVE-2026-26010 Leaks the Keys to the Kingdom A critical information disclosure vulnerability in OpenMetadata's REST API allowed authenticated users with minimal privileges to retrieve the raw JWT tokens of t... https://cvereports.com/reports/CVE-2026-26010
Post summary
The text announces a critical information disclosure in OpenMetadata’s REST API that lets low-privilege authenticated users retrieve raw JWT tokens, with no indication of exploitation, PoC, or patch.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | open-metadata | openmetadata | - | - | - |