PatchTheCVEopenmetadata vulnerabilities and fixes
Recent CVEs affecting openmetadata, with upgrade or downgrade steps. 12 tracked.
openmetadata has 12 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 12. Most recent: 2026-02-11. Highest priority: CVE-2024-28255 (score 72/100).
- CVE-2026-22244 HIGH 7.2 UPGRADE OpenMetadata is a unified metadata platform
- CVE-2026-26010 HIGH 7.6 UPGRADE OpenMetadata is a unified metadata platform
- CVE-2025-50468 MEDIUM 6.5 UPGRADE OpenMetadata <=1.4.4 is vulnerable to SQL Injection
- CVE-2025-50467 MEDIUM 6.5 UPGRADE OpenMetadata <=1.4.4 is vulnerable to SQL Injection
- CVE-2025-50466 HIGH 7.1 UPGRADE OpenMetadata <=1.4.4 is vulnerable to SQL Injection
- CVE-2025-50465 HIGH 7.1 UPGRADE OpenMetadata <=1.4.4 is vulnerable to SQL Injection
- CVE-2024-55238 HIGH 7.1 UPGRADE OpenMetadata <=1.4.1 is vulnerable to SQL Injection
- CVE-2024-28848 HIGH 8.8 UPGRADE OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata
- CVE-2024-28847 HIGH 8.8 UPGRADE OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata
- CVE-2024-28255 CRITICAL 9.8 UPGRADE OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata
- CVE-2024-28254 HIGH 8.8 UPGRADE OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata
- CVE-2024-28253 CRITICAL 9.4 UPGRADE OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata
FAQ
How do I fix openmetadata vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is openmetadata being exploited right now?
None of the tracked openmetadata CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which openmetadata CVE should I patch first?
CVE-2024-28255 currently ranks highest (72/100): OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata .