CVE-2026-100373: OpenMetadata SSRF Vulnerability

CVE-2026-100373 Overview

CVE-2026-100373 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] affecting OpenMetadata through version 2.0.2. The flaw resides in the URLValidator.validateURL function, which fails to resolve DNS hostnames and validate internal addresses before dispatching webhook requests. Authenticated users with permission to create or update an EventSubscription can set webhook destinations to internal hosts. The server then issues outbound requests to private networks or cloud metadata endpoints and returns HTTP status codes that enable blind SSRF probing of the internal environment.

Critical Impact
Attackers with webhook configuration privileges can probe internal networks and reach cloud metadata services such as 169.254.169.254, potentially exposing instance credentials and internal service topology.

Affected Products

OpenMetadata versions up to and including 2.0.2
URLValidator component in openmetadata-service
EventSubscription webhook dispatch functionality

Discovery Timeline

2026-09-25 - CVE-2026-100373 published to NVD
2026-09-25 - Last updated in NVD database

Technical Details for CVE-2026-100373

Vulnerability Analysis

The vulnerability stems from incomplete URL validation inside the URLValidator.validateURL method located in openmetadata-service/src/main/java/org/openmetadata/service/util/URLValidator.java. The validator inspects user-supplied webhook URLs but does not resolve the hostname to an IP address prior to allowlisting checks. Attackers can supply hostnames that resolve to RFC1918 addresses, loopback interfaces, or cloud metadata endpoints such as 169.254.169.254.

Because OpenMetadata dispatches HTTP requests to the configured webhook when alerts fire, the server acts as a confused deputy. Response status codes returned to the caller enable blind SSRF enumeration of internal services, open ports, and metadata APIs. Exploitation requires high privileges—specifically the ability to create or modify EventSubscription entities—so the attack surface is limited to authenticated administrators or compromised integration accounts.

Root Cause

The root cause is missing hostname-to-IP resolution and absent policy enforcement at dispatch time. URLValidator performed syntactic checks against the raw URL rather than resolving DNS and evaluating the destination IP against a blocklist of internal ranges. This design permitted DNS rebinding–style bypasses and direct references to internal hostnames.

Attack Vector

An authenticated user with EventSubscription write permissions submits a webhook destination pointing at an internal resource. OpenMetadata validates the URL, accepts it, and later dispatches event payloads via HTTP. The HTTP response is reflected back through subscription status fields, enabling blind probing. See the URLValidator source snippet and the VulnCheck advisory for the full exploitation chain.

java

// Patch excerpt: WebhookSinkProvider.java
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.fasterxml.jackson.dataformat.yaml.YAMLFactory;
 import jakarta.ws.rs.client.Client;
-import jakarta.ws.rs.client.ClientBuilder;
 import jakarta.ws.rs.client.Entity;
 import jakarta.ws.rs.client.Invocation;
 import jakarta.ws.rs.client.WebTarget;
// Source: https://github.com/open-metadata/OpenMetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f

The patch replaces the direct ClientBuilder instantiation with a resolver-aware client that enforces outbound policy at dispatch time, closing the gap between validation and request execution.

Detection Methods for CVE-2026-100373

Indicators of Compromise

Outbound HTTP requests from the OpenMetadata server process to RFC1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or link-local addresses (169.254.0.0/16).
EventSubscription entities whose destinations field references internal hostnames, loopback addresses, or cloud metadata endpoints.
Repeated webhook dispatch failures or unusual HTTP status codes recorded in OpenMetadata subscription status logs.

Detection Strategies

Audit the OpenMetadata database for EventSubscription records containing non-public URLs by querying webhook destination fields.
Inspect application logs for URLValidator.validateURL entries accepting URLs that resolve to internal IP space.
Correlate privileged user activity (subscription create/update operations) with subsequent outbound traffic from the OpenMetadata host.

Monitoring Recommendations

Enable egress filtering and alert on connections from the OpenMetadata workload to 169.254.169.254 and private subnets.
Log and review all EventSubscription create and update API calls, including the submitting identity and destination URL.
Monitor cloud provider metadata service access logs where available (for example, IMDSv2 session token requests from unexpected workloads).

How to Mitigate CVE-2026-100373

Immediate Actions Required

Upgrade OpenMetadata to a release containing commit 8f44482ac89bad9227df5b7f79beca2efe50c05f or later.
Review all existing EventSubscription entries and remove webhooks pointing at internal, loopback, or metadata addresses.
Restrict the roles permitted to create or modify EventSubscription resources to a minimal set of administrators.

Patch Information

The fix is delivered in OpenMetadata commit 8f44482, titled "fix(alerts): resolve outbound URLs and enforce the policy at dispatch (#33439)". The patch modifies WebhookSinkProvider.java and EventSubscriptionRepository.java to resolve destination hostnames and enforce the outbound policy at the moment of dispatch, closing the time-of-check to time-of-use gap. Tracking is available in OpenMetadata issue #32592.

Workarounds

Enforce network-level egress controls on the OpenMetadata workload to block connections to private IP ranges and cloud metadata endpoints.
Require IMDSv2 on AWS instances hosting OpenMetadata to raise the bar for metadata credential theft via SSRF.
Restrict EventSubscription write permissions through role-based access control until the patched version is deployed.

bash

# Example AWS security group egress restriction (deny metadata service)
# Use iptables on the OpenMetadata host to block the IMDS endpoint
sudo iptables -A OUTPUT -d 169.254.169.254 -m owner ! --uid-owner root -j REJECT
sudo iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 80 -j REJECT
sudo iptables -A OUTPUT -d 192.168.0.0/16 -p tcp --dport 80 -j REJECT