Executive brief
OpenMetadata is a platform used by organizations to manage and catalog their data assets. A security flaw allowed standard users to trick the system into revealing sensitive credentials, including cleartext database passwords and internal system tokens. An attacker with basic access could use this information to gain administrative-level control over data services, potentially leading to unauthorized data access or modification.
Technical details
A vulnerability in the OpenMetadata automation workflow API (specifically the TEST_CONNECTION type) allows authenticated non-admin users to leak sensitive credentials. When a user initiates a connection test via 'POST /api/v1/automations/workflows', the server's HTTP 201 response includes the cleartext database password in the 'request.connection.config.password' field and an ingestion bot JWT in the 'openMetadataServerConnection.securityConfig.jwtToken' field. This occurs because the server fails to mask sensitive fields in the workflow response. An attacker can reuse the leaked bot token to authenticate as a high-privilege service account, granting them broad access to sensitive service APIs and metadata. The issue is addressed in version 1.12.4.
Affected products
- OpenMetadata OpenMetadata Prior to 1.12.4
Timeline
- 2026-05-14: disclosed: Initial advisory published on GitHub
- 2026-06-08: advisory: CVE published in NVD
- 2026-06-08: patched: Fix confirmed available in version 1.12.4