High severity8.3GHSA Advisory· Published Jun 8, 2026· Updated Jun 9, 2026

CVE-2026-46481

Description

OpenMetadata is a unified metadata platform. Prior to version 1.12.4, a non-admin SSO user can trigger a TEST_CONNECTION workflow for a Database Service and receive, in the HTTP 201 response of POST /api/v1/automations/workflows, both the cleartext database password in request.connection.config.password and the ingestion bot JWT in openMetadataServerConnection.securityConfig.jwtToken. The leaked ingestion-bot token can then be reused as Authorization: Bearer to access sensitive service APIs with bot-level privileges. This issue has been patched in version 1.12.4.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.open-metadata:openmetadata-serviceMaven	< 1.12.4	1.12.4

Affected products

Open Metadata/OpenmetadataGHSA
Range: < 1.12.4

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-9vmh-whc4-7phgghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-46481ghsaADVISORY
github.com/open-metadata/OpenMetadata/security/advisories/GHSA-9vmh-whc4-7phgnvdWEB

News mentions

No linked articles in our index yet.

cvss	0.540
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000