CVE-2025-50468: SQL Injection
Published Aug 8, 2025
·Updated
OpenMetadata <=1.4.4 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the DocStoreDAO interface. The entityType parameters can be used to build a SQL query.
Affected Software
2 affected components
OpenMetadata OpenMetadata<=1.4.4
open-metadata OpenMetadata<=1.4.4
Event History
Aug 8, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·05:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-50468?
CVE-2025-50468 is rated as a high-severity vulnerability due to the potential for SQL injection attacks.
2
How do I fix CVE-2025-50468?
To mitigate the SQL injection vulnerability in CVE-2025-50468, update OpenMetadata to version 1.4.5 or later.
3
What types of attacks can be executed through CVE-2025-50468?
An attacker exploiting CVE-2025-50468 can execute arbitrary SQL queries to extract sensitive data from the database.
4
Which software versions are affected by CVE-2025-50468?
CVE-2025-50468 affects OpenMetadata versions up to and including 1.4.4.
5
What component of OpenMetadata is vulnerable in CVE-2025-50468?
The vulnerability in CVE-2025-50468 resides in the listCount function within the DocStoreDAO interface.