Quick answers
- Is CVE-2026-81029 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-81029 being exploited in the wild.
- How severe is CVE-2026-81029?
- High severity, with a CVSS score of 8.1, published 26 August 2026.
- Which products and versions are affected?
- OpenMetadata versions prior to 2.0.0.
- Is there a fix for CVE-2026-81029?
- A patch was published on 2026: Fixed in version 2.0.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-81029 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-81029?
- Check whether you run OpenMetadata at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an open redirect combined with token leakage that affects the SAML, OIDC, and OAuth2 authentication handlers in OpenMetadata versions prior to 2.0.0. The SamlLoginServlet reads an attacker-controlled callback parameter from the HTTP request, stores it in the session without validating it against any allowlist, and the assertion consumer servlet later constructs a redirect URL containing the freshly issued JWT token, user email, and user name, directing the browser to the attacker's destination. The same flaw exists in the OIDC and OAuth2 handlers with their own redirect parameters. Attack preconditions are minimal—no authentication is required from the attacker, only social engineering to cause a victim to visit a malicious link. An attacker can capture valid JWT tokens and use them to impersonate users and access the API. Version 2.0.0 removes the caller-supplied callback parameter entirely; no 1.x release contains a fix.
Affected products
- OpenMetadata OpenMetadata versions prior to 2.0.0
Timeline
- 2026-08-26: disclosed
- 2026: patched: Fixed in version 2.0.0