# CVE-2026-46481: OpenMetadata sensitive information leak in TEST_CONNECTION workflow

Source: https://junglewise.ai/threats/cve-2026-46481-openmetadata-sensitive-information-leak-in-test-connection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-08. Updated: 2026-06-08  
License: CC BY 4.0 with a link back

CVE-2026-46481 · Severity: high · CVSS 8.3 · Published 2026-06-08

OpenMetadata is a platform used by organizations to manage and catalog their data assets. A security flaw allowed standard users to trick the system into revealing sensitive credentials, including cleartext database passwords and internal system tokens. An attacker with basic access could use this information to gain administrative-level control over data services, potentially leading to unauthorized data access or modification.

Technologies: [org.open-metadata:openmetadata-service (Maven)](https://junglewise.ai/threats/technologies/org-open-metadata-openmetadata-service), [OpenMetadata](https://junglewise.ai/threats/technologies/openmetadata). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [OpenMetadata](https://junglewise.ai/threats/vendors/openmetadata).

## Quick answers

**Is CVE-2026-46481 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46481 being exploited in the wild.

**How severe is CVE-2026-46481?** High severity, with a CVSS score of 8.3, published 8 June 2026.

**Which products and versions are affected?** org.open-metadata:openmetadata-service (Maven) < 1.12.4, ECOSYSTEM:introduced=0,fixed=1.12.4; OpenMetadata < 1.12.4, Prior to 1.12.4.

**Is there a fix for CVE-2026-46481?** Yes. org.open-metadata:openmetadata-service (Maven): upgrade to 1.12.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46481 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-46481?** Check whether you run org.open-metadata:openmetadata-service (Maven) or OpenMetadata at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.open-metadata:openmetadata-service (Maven): upgrade to 1.12.4 or later

  ```sh
  # set org.open-metadata:openmetadata-service to 1.12.4 in your pom.xml or build.gradle
  ```


## Technical details

A vulnerability in the OpenMetadata automation workflow API (specifically the TEST_CONNECTION type) allows authenticated non-admin users to leak sensitive credentials. When a user initiates a connection test via 'POST /api/v1/automations/workflows', the server's HTTP 201 response includes the cleartext database password in the 'request.connection.config.password' field and an ingestion bot JWT in the 'openMetadataServerConnection.securityConfig.jwtToken' field. This occurs because the server fails to mask sensitive fields in the workflow response. An attacker can reuse the leaked bot token to authenticate as a high-privilege service account, granting them broad access to sensitive service APIs and metadata. The issue is addressed in version 1.12.4.

## Affected products

- OpenMetadata OpenMetadata Prior to 1.12.4

## Identifiers

- CVE-2026-46481
- GHSA-9vmh-whc4-7phg

## Timeline

- 2026-05-14: disclosed: Initial advisory published on GitHub
- 2026-06-08: advisory: CVE published in NVD
- 2026-06-08: patched: Fix confirmed available in version 1.12.4

## References

- [https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-9vmh-whc4-7phg](https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-9vmh-whc4-7phg)

## Related threats

- [OpenMetadata server-side request forgery in URLValidator](https://junglewise.ai/threats/cve-2026-100373-openmetadata-through-2-0-2-contains-a-server-side-request)
- [OpenMetadata token leakage via unvalidated post-authentication redirect](https://junglewise.ai/threats/cve-2026-81029-openmetadata-token-leakage-via-unvalidated-post-authentication)
- [OpenMetadata SQL Injection](https://junglewise.ai/threats/cve-2024-55238-openmetadata-sql-injection)
- [OpenMetadata vulnerable to a SpEL Injection in `GET /api/v1/policies/validation/condition/<expr>` (`GHSL-2023-236`)](https://junglewise.ai/threats/cve-2024-28848-openmetadata-vulnerable-to-a-spel-injection-in-get-api-v1)
- [OpenMetadata vulnerable to a SpEL Injection in `PUT /api/v1/events/subscriptions` (`GHSL-2023-251`)](https://junglewise.ai/threats/cve-2024-28847-openmetadata-vulnerable-to-a-spel-injection-in-put-api-v1-events)