Unvalidated Redirect Vulnerability in OpenMetadata by OpenMetadata

CVE-2026-81029

What is CVE-2026-81029?

OpenMetadata has a vulnerability where it accepts a post-authentication redirect target provided by the caller. This is particularly concerning as the SamlLoginServlet stores this target in the HTTP session without necessary validations against registered destinations. As a result, an attacker could manipulate the redirect to gain control of user accounts by forcing a valid token to be issued to a destination they control. This flaw not only affects the integrity of user sessions but also poses a significant risk of unauthorized access to sensitive accounts. The issue was addressed in version 2.0.0, which removes the vulnerable callback parameter, while all earlier versions remain susceptible.

References