CVE-2026-46481
published 2026-06-08CVE-2026-46481: OpenMetadata is a unified metadata platform. Prior to version 1.12.4, a non-admin SSO user can trigger a TEST_CONNECTION workflow for a Database Service and…
PriorityP353high8.3CVSS 3.1
AVNACLPRLUINSUCHIHAL
EPSS
0.24%
15.1th percentile
OpenMetadata is a unified metadata platform. Prior to version 1.12.4, a non-admin SSO user can trigger a TEST_CONNECTION workflow for a Database Service and receive, in the HTTP 201 response of POST /api/v1/automations/workflows, both the cleartext database password in request.connection.config.password and the ingestion bot JWT in openMetadataServerConnection.securityConfig.jwtToken. The leaked ingestion-bot token can then be reused as Authorization: Bearer to access sensitive service APIs with bot-level privileges. This issue has been patched in version 1.12.4.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| open-metadata | openmetadata | < 1.12.4 | 1.12.4 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
open-metadata OpenMetadata up to 1.12.3 Database Service workflows insertion of sensitive information into sent data (GHSA-9vmh-whc4-7phg)
vuldb·2026-06-08·CVSS 8.3
CVE-2026-46481 [HIGH] open-metadata OpenMetadata up to 1.12.3 Database Service workflows insertion of sensitive information into sent data (GHSA-9vmh-whc4-7phg)
A vulnerability has been found in open-metadata OpenMetadata up to 1.12.3 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /api/v1/automations/workflows of the component Database Service. The manipulation leads to insertion of sensitive information into sent data.
This vulnerability is documented as CVE-2026-46481. The attack can be initiated remotely. There is not any exploit available.
The affected component should be upgraded.
GHSA
OpenMetadata: TEST_CONNECTION workflow leaks ingestion-bot JWT and database password to regular users
ghsa·2026-05-21
CVE-2026-46481 [HIGH] CWE-201 OpenMetadata: TEST_CONNECTION workflow leaks ingestion-bot JWT and database password to regular users
OpenMetadata: TEST_CONNECTION workflow leaks ingestion-bot JWT and database password to regular users
**This is not applicable if an application is configuring the Secrets Store to store credentials. Please make sure to follow the best practices when deploying in production**
In OpenMetadata 1.12.1, a non-admin SSO user can trigger a `TEST_CONNECTION` workflow for a Database Service and receive, in the HTTP 201 response of `POST /api/v1/automations/workflows`, both:
- The cleartext database password in `request.connection.config.password`.
- The ingestion bot JWT in `openMetadataServerConnection.securityConfig.jwtToken`.
The leaked ingestion-bot token can then be reused as `Authorization: Bearer ` to access sensitive service APIs (for example, `GET /api/v1/services/databaseServices/{id}
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-08
Published