CVE-2026-22244 Overview
OpenMetadata, a unified metadata platform for data discovery, governance, and collaboration, contains a critical Server-Side Template Injection (SSTI) vulnerability in FreeMarker email templates. This vulnerability allows authenticated administrators to achieve remote code execution on the underlying server by injecting malicious template directives into email template configurations.
Critical Impact
Authenticated attackers with administrative privileges can execute arbitrary code on the OpenMetadata server through malicious FreeMarker template injection, potentially leading to complete system compromise.
Affected Products
- OpenMetadata versions prior to 1.11.4
Discovery Timeline
- 2026-01-08 - CVE-2026-22244 published to NVD
- 2026-01-08 - Last updated in NVD database
Technical Details for CVE-2026-22244
Vulnerability Analysis
This vulnerability exists due to improper sanitization of user-controlled input within FreeMarker email templates. FreeMarker is a Java-based template engine commonly used for generating dynamic content such as emails, HTML pages, and configuration files. When user input is directly interpolated into FreeMarker templates without proper sandboxing or input validation, attackers can inject malicious template directives that execute arbitrary Java code on the server.
The vulnerability requires administrative privileges to exploit, as only administrators have access to modify email template configurations. However, once exploited, the impact is severe—attackers can execute arbitrary commands with the privileges of the OpenMetadata application, potentially compromising the entire underlying infrastructure.
Root Cause
The root cause is classified under CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine). The OpenMetadata application fails to properly sanitize or restrict template expressions in FreeMarker email templates, allowing attackers to inject special directives that can instantiate Java objects and invoke methods leading to code execution.
Attack Vector
The attack is network-based and requires the attacker to have valid administrative credentials to the OpenMetadata platform. Once authenticated, the attacker can modify email templates to include malicious FreeMarker directives. Common SSTI payloads for FreeMarker involve using built-in objects like freemarker.template.utility.Execute or freemarker.template.utility.ObjectConstructor to execute system commands or instantiate arbitrary Java objects.
The security patch addresses this vulnerability by updating the jersey-bom dependency:
<dropwizard.version>4.0.14</dropwizard.version>
<dropwizard-jdbi3.version>4.0.14</dropwizard-jdbi3.version>
<diffMatch.version>1.0</diffMatch.version>
- <jersey-bom.version>3.1.5</jersey-bom.version>
+ <jersey-bom.version>3.1.10</jersey-bom.version>
<javax.ws.rs-api.version>2.1.1</javax.ws.rs-api.version>
<!-- update from here -->
<jakarta.servlet-api.version>6.0.0</jakarta.servlet-api.version>
Source: GitHub Commit Update
Detection Methods for CVE-2026-22244
Indicators of Compromise
- Unusual modifications to email template configurations in OpenMetadata
- Unexpected process spawning from the OpenMetadata Java application
- Suspicious outbound network connections from the OpenMetadata server
- Audit log entries showing administrative changes to email templates
Detection Strategies
- Monitor administrative audit logs for changes to email template configurations
- Implement application-level logging for template rendering operations
- Deploy runtime application self-protection (RASP) to detect template injection attempts
- Use endpoint detection to identify unusual child processes spawned by Java applications
Monitoring Recommendations
- Enable verbose logging for the OpenMetadata application and review for anomalies
- Configure alerts for administrative configuration changes, especially to email-related settings
- Monitor server resource utilization for unexpected command execution patterns
- Implement network monitoring for unusual egress traffic from OpenMetadata servers
How to Mitigate CVE-2026-22244
Immediate Actions Required
- Upgrade OpenMetadata to version 1.11.4 or later immediately
- Audit administrative accounts and revoke unnecessary privileges
- Review recent changes to email template configurations for suspicious content
- Restrict network access to the OpenMetadata administrative interface
Patch Information
The vulnerability has been patched in OpenMetadata version 1.11.4. The fix is available in commit bffe7c45807763f9b682021d4211c478d2a08bb3. Organizations should upgrade to the patched version as soon as possible. For detailed patch information, refer to the GitHub Security Advisory GHSA-5f29-2333-h9c7.
Workarounds
- Implement strict access controls to limit administrative privileges to trusted personnel only
- Deploy a Web Application Firewall (WAF) to filter potentially malicious template expressions
- Consider network segmentation to isolate OpenMetadata from critical infrastructure
- Monitor and alert on any changes to email template configurations until patching is complete
# Example: Restrict administrative interface access via firewall
# Allow only trusted admin IP addresses to access OpenMetadata admin endpoints
iptables -A INPUT -p tcp --dport 8585 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8585 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
