CVE-2026-22244: OpenMetadata server-side template injection in FreeMarker email templates

Quick answers

Is CVE-2026-22244 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-22244 being exploited in the wild.

How severe is CVE-2026-22244?

Critical severity, with a CVSS score of 9.1, published 8 January 2026.

Which products and versions are affected?

org.open-metadata:platform (Maven) >= 1.5.0, < 1.11.4, ECOSYSTEM:introduced=1.5.0,fixed=1.11.4.

Is there a fix for CVE-2026-22244?

Yes. org.open-metadata:platform (Maven): upgrade to 1.11.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-22244 attacked?

It is attacked over the network.

Am I affected by CVE-2026-22244?

Check whether you run org.open-metadata:platform (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

• org.open-metadata:platform (Maven): upgrade to 1.11.4 or later

  # set org.open-metadata:platform to 1.11.4 in your pom.xml or build.gradle

Technical details

The vulnerability is a server-side template injection (SSTI) in the DefaultTemplateProvider.getTemplate() method. User-supplied email templates are loaded from the database and rendered with FreeMarker using an unsafe Configuration object that does not enable TemplateClassResolver.SAFER_RESOLVER or disable API built-ins. An attacker with admin privileges can use the PATCH /api/v1/docStore/{templateId} endpoint to inject FreeMarker directives like &lt;#assign ex="freemarker.template.utility.Execute"?new()&gt;, which instantiate the Execute class and run shell commands. The malicious template is triggered when emails are sent (e.g., via password reset, user invitations, or test email endpoints). Commands execute as the OpenMetadata server process user, potentially exposing environment variables, database credentials, and allowing further lateral movement.

Affected products

• Open Metadata OpenMetadata >= 1.5.0, < 1.11.4

Identifiers

• CVE-2026-22244
• GHSA-5f29-2333-h9c7

Timeline

• 2026-01-07: disclosed: GitHub Advisory published
• 2026-01-07: advisory: CVE-2026-22244 / GHSA-5f29-2333-h9c7 released
• 2026-01-07: patched: Patched in version 1.11.4

References

• https://api.github.com/users/lnlinh31
• https://github.com/lnlinh31
• https://api.github.com/users/lnlinh31/gists%7B/gist_id%7D
• https://api.github.com/users/lnlinh31/repos
• https://avatars.githubusercontent.com/u/49328655?v=4
• https://api.github.com/users/lnlinh31/events%7B/privacy%7D