CVE-2026-100373CWE-918ssrf

CVE-2026-100373

Medium · published September 26, 2026

CVSS v3.1
4.1
EPSS
0%
Percentile
17.1
In the wild
Unconfirmed
What it is

OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses. Users permitted to create or update EventSubscription can set webhook destinations to internal hosts, allowing the server to send requests to private networks and cloud metadata endpoints while returning HTTP status codes that enable blind SSRF probing.

The record
Technical detail
CVSS v3.1
4.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
5.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
EPSS
0.00262 · 17.1th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-09-26T00:17Z
References (6)
https://gist.github.com/naif-alfardan/8a69e0648e11b07abe63f949346179c1 · [email protected]https://github.com/open-metadata/OpenMetadata · [email protected]https://github.com/open-metadata/OpenMetadata/blob/2.0.2-release/openmetadata-service/src/main/java/org/openmetadata/service/util/URLValidator.java#L34-L47 · [email protected]https://github.com/open-metadata/OpenMetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f · [email protected]https://github.com/open-metadata/OpenMetadata/issues/32592 · [email protected]https://www.vulncheck.com/advisories/openmetadata-through-2.0.2-ssrf-via-webhook-url-validation-bypass · [email protected]
EPSS history
Timeline
  • 27 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 25 SEP 19:38Z
    OpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypass
    cvelistv5