CVE-2025-50466: SQL Injection
OpenMetadata <=1.4.4 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the TestDefinitionDAO interface. The entityType parameter can be used to build a SQL query.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-50466?
CVE-2025-50466 is classified as a critical vulnerability due to its potential for SQL Injection.
How do I fix CVE-2025-50466?
To fix CVE-2025-50466, upgrade to OpenMetadata version 1.4.5 or later where the vulnerability has been addressed.
What impact does CVE-2025-50466 have on database security?
CVE-2025-50466 allows attackers to execute unauthorized SQL queries, which can lead to unauthorized data access and data disclosure.
Which versions of OpenMetadata are affected by CVE-2025-50466?
CVE-2025-50466 affects all versions of OpenMetadata up to and including version 1.4.4.
What is the vector for exploiting CVE-2025-50466?
The vulnerability in CVE-2025-50466 can be exploited by manipulating the entityType parameter in SQL queries.