CVE-2026-46481: OpenMetadata sensitive information leak in TEST_CONNECTION workflow

CVE-2026-46481 · Severity: high · CVSS 8.3 · Published 2026-06-08

OpenMetadata is a platform used by organizations to manage and catalog their data assets. A security flaw allowed standard users to trick the system into revealing sensitive credentials, including cleartext database passwords and internal system tokens. An attacker with basic access could use this information to gain administrative-level control over data services, potentially leading to unauthorized data access or modification.

Technologies: org.open-metadata:openmetadata-service (Maven), OpenMetadata. Vendors: Maven, OpenMetadata.

Quick answers

Is CVE-2026-46481 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-46481 being exploited in the wild.
How severe is CVE-2026-46481?
High severity, with a CVSS score of 8.3, published 8 June 2026.
Which products and versions are affected?
org.open-metadata:openmetadata-service (Maven) < 1.12.4, ECOSYSTEM:introduced=0,fixed=1.12.4; OpenMetadata < 1.12.4, Prior to 1.12.4.
Is there a fix for CVE-2026-46481?
Yes. org.open-metadata:openmetadata-service (Maven): upgrade to 1.12.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46481 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-46481?
Check whether you run org.open-metadata:openmetadata-service (Maven) or OpenMetadata at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.open-metadata:openmetadata-service (Maven): upgrade to 1.12.4 or later
    # set org.open-metadata:openmetadata-service to 1.12.4 in your pom.xml or build.gradle

Technical details

A vulnerability in the OpenMetadata automation workflow API (specifically the TEST_CONNECTION type) allows authenticated non-admin users to leak sensitive credentials. When a user initiates a connection test via 'POST /api/v1/automations/workflows', the server's HTTP 201 response includes the cleartext database password in the 'request.connection.config.password' field and an ingestion bot JWT in the 'openMetadataServerConnection.securityConfig.jwtToken' field. This occurs because the server fails to mask sensitive fields in the workflow response. An attacker can reuse the leaked bot token to authenticate as a high-privilege service account, granting them broad access to sensitive service APIs and metadata. The issue is addressed in version 1.12.4.

Affected products

  • OpenMetadata OpenMetadata Prior to 1.12.4

Identifiers

  • CVE-2026-46481
  • GHSA-9vmh-whc4-7phg

Timeline

  • 2026-05-14: disclosed: Initial advisory published on GitHub
  • 2026-06-08: advisory: CVE published in NVD
  • 2026-06-08: patched: Fix confirmed available in version 1.12.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.