Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
open-metadata/openmetadata
main @ 294c982
311
Fixes
12
CVEs
CRITICAL
Peak severity
24.3%
Coverage
Highlights
Auth Bypass: 186 prior fixes. Scrutinize any change in this area.
openmetadata-service: most-fixed (91 issues). Treat as high-risk during review.
144 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The JWT filter has been a recurring vector for critical authentication bypasses due to loose substring matching in exclusion lists and improper path parsing (including the 'version' bypass). Exploitation of this surface allowed unauthenticated users to reach sensitive endpoints.
Sandbox Escape: OpenMetadata's policy, rule, and alert validation endpoints historically evaluated untrusted Spring Expression Language (SpEL) templates without strict sandboxing. Attackers could utilize SpEL injection to execute arbitrary commands.
Information Disclosure: Service and pipeline configuration schemas consistently failed to mask or encrypt sensitive secrets (such as JWT tokens, Slack user tokens, and database credentials) at rest and during API serialization, leaking private connection strings to read-only users.