CVE-2026-100373: OpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypass
OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses. Users permitted to create or update EventSubscription can set webhook destinations to internal hosts, allowing the server to send requests to private networks and cloud metadata endpoints while returning HTTP status codes that enable blind SSRF probing.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A user who is permitted to create or update an EventSubscription can exploit it by configuring its webhook destination. The attacker does not need user interaction, and the attack can be performed remotely.
What systems could be reached through the vulnerable webhook?
The OpenMetadata server can be induced to send requests to internal hosts on private networks and to cloud metadata endpoints. HTTP status codes returned to the user can support blind probing of those targets.
Is the default configuration affected?
The provided information does not establish whether EventSubscription creation or update permissions are granted by default. Exposure depends on whether users with those permissions can configure webhook destinations.
How can I determine whether my deployment is affected?
Deployments running OpenMetadata through 2.0.2 should be considered affected if users can create or update EventSubscription webhook URLs. Review EventSubscription configurations for destinations resolving to private or internal addresses, including cloud metadata endpoints.
What can be done if upgrading is not immediately possible?
Restrict create and update permissions for EventSubscription to trusted administrators and review existing webhook destinations. Prevent the OpenMetadata server from reaching private networks and cloud metadata endpoints where network controls allow it.