CVE-2026-26010
Leaky JWTs in OpenMetadata exposing highly-privileged bot users
- State
- Published
- Severity
- 7.6 High
- Published
- Feb 11, 2026
- Updated
- Feb 12, 2026
- Reserved
- Feb 9, 2026
Description
OpenMetadata is a unified metadata platform. Prior to 1.11.8, calls issued by the UI against /api/v1/ingestionPipelines leak JWTs used by ingestion-bot for certain services (Glue / Redshift / Postgres). Any read-only user can gain access to a highly privileged account, typically which has the Ingestion Bot Role. This enables destructive changes in OpenMetadata instances, and potential data leakage (e.g. sample data, or service metadata which would be unavailable per roles/policies). This vulnerability is fixed in 1.11.8.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 7.6 High | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L | GitHub_M |
Weaknesses
- CWE-269 Improper Privilege Management
Affected Products
| Product | Versions |
|---|---|
OpenMetadataopen-metadata |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.