CVE-2026-100373

Deferred Deferred - Pending Action

OpenMetadata SSRF via Unvalidated URL in EventSubscription

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: VulnCheck

Description

OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses. Users permitted to create or update EventSubscription can set webhook destinations to internal hosts, allowing the server to send requests to private networks and cloud metadata endpoints while returning HTTP status codes that enable blind SSRF probing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-100373

Affected Vendors & Products

Vendor	Product	Version / Range
openmetadata	openmetadata	to 2.0.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

OpenMetadata through version 2.0.2 has a server-side request forgery (SSRF) vulnerability in the URLValidator.validateURL function. It fails to properly resolve DNS hostnames and validate internal addresses, allowing users with permission to create or update EventSubscription to set webhook destinations to internal hosts. This lets the server send requests to private networks and cloud metadata endpoints while returning HTTP status codes that enable blind SSRF probing.

Detection Guidance

To detect this SSRF vulnerability in OpenMetadata, monitor network traffic for outbound requests from the OpenMetadata server to internal or unexpected hosts. Check webhook configurations for EventSubscriptions pointing to private IP ranges or cloud metadata endpoints. Review server logs for HTTP status codes indicating failed connections to internal services.

Impact Analysis

This vulnerability allows attackers with limited permissions to probe internal networks and cloud metadata endpoints. It could lead to unauthorized access to sensitive data, internal service enumeration, or potential data exfiltration if combined with other vulnerabilities. The impact depends on the network configuration and the services exposed internally.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized network access and potential data breaches. GDPR requires protecting personal data, and HIPAA requires safeguarding protected health information. A successful SSRF attack could lead to unauthorized data exposure, resulting in regulatory penalties and loss of trust.

Mitigation Strategies

Upgrade OpenMetadata to a version beyond 2.0.2 to address the SSRF vulnerability in URL validation. Restrict user permissions to prevent untrusted users from creating or updating EventSubscriptions with internal webhook destinations. Monitor network traffic for unusual internal requests originating from the OpenMetadata server.

Hi! I’m here to help you understand CVE-2026-100373. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70