JWT Exposure in OpenMetadata 1.11.8 Leading to Unauthorized Access

CVE-2026-26010

What is CVE-2026-26010?

OpenMetadata, a unified metadata platform, has a vulnerability where calls made from the UI to the /api/v1/ingestionPipelines endpoint can leak JWTs associated with ingestion-bot services such as Glue, Redshift, and Postgres. This flaw allows any read-only user to access a highly privileged account, typically reserved for the Ingestion Bot Role. The implications of this vulnerability are severe, leading to potential unauthorized alterations and data leaks, including sensitive sample data and service metadata that should remain restricted based on user roles and policies. The issue was addressed in version 1.11.8, ensuring better protection against these threats.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References