CVE-2026-26010 Overview
CVE-2026-26010 is a privilege escalation vulnerability in OpenMetadata, a unified metadata platform used for data discovery, governance, and collaboration. Prior to version 1.11.8, the /api/v1/ingestionPipelines endpoint improperly exposes JSON Web Tokens (JWTs) used by the ingestion-bot service when responding to UI-initiated API calls. This vulnerability allows any authenticated user, including those with read-only permissions, to obtain highly privileged credentials associated with the Ingestion Bot Role.
Critical Impact
Any read-only user can escalate privileges to the Ingestion Bot Role, enabling unauthorized destructive changes to OpenMetadata instances and potential data exfiltration including sample data and service metadata from connected services like AWS Glue, Redshift, and PostgreSQL.
Affected Products
- OpenMetadata versions prior to 1.11.8
- Environments with AWS Glue, Redshift, or PostgreSQL ingestion pipelines configured
- OpenMetadata deployments with multi-user access
Discovery Timeline
- 2026-02-11 - CVE-2026-26010 published to NVD
- 2026-02-12 - Last updated in NVD database
Technical Details for CVE-2026-26010
Vulnerability Analysis
This vulnerability stems from improper privilege management (CWE-269) in the OpenMetadata API layer. When the user interface makes requests to the /api/v1/ingestionPipelines endpoint, the server response includes sensitive JWT tokens that are used internally by the ingestion-bot service to authenticate against connected data sources such as AWS Glue, Amazon Redshift, and PostgreSQL databases.
The fundamental issue is that the API response does not properly filter or redact sensitive credential information before returning data to the client. This means that any authenticated user—regardless of their assigned role or permissions within OpenMetadata—can observe these tokens by simply inspecting API responses in their browser's developer tools or by making direct API calls.
The leaked JWTs typically grant the Ingestion Bot Role, which possesses elevated privileges necessary for automated data ingestion operations. An attacker who captures these tokens can impersonate the ingestion-bot, bypassing normal role-based access controls and gaining unauthorized access to perform administrative actions.
Root Cause
The root cause of CVE-2026-26010 is improper privilege management in the API response serialization logic. The ingestion pipeline endpoint returns complete configuration objects that include JWT credentials without implementing proper field-level access controls or credential redaction. This design flaw violates the principle of least privilege by exposing sensitive authentication tokens to users who should not have access to them.
Attack Vector
The attack can be executed over the network by any authenticated user with basic read access to the OpenMetadata platform. The attacker simply needs to:
- Authenticate to OpenMetadata with any valid user account (including read-only accounts)
- Navigate to or make API requests against the /api/v1/ingestionPipelines endpoint
- Capture the JWT tokens from the API response
- Use the captured tokens to authenticate as the ingestion-bot service
- Perform privileged operations such as modifying metadata, accessing sensitive data samples, or making destructive changes to the OpenMetadata instance
The vulnerability is particularly concerning in environments with multiple user tiers, where data stewards or analysts with limited permissions could escalate to administrative access.
Detection Methods for CVE-2026-26010
Indicators of Compromise
- Unusual API activity from the /api/v1/ingestionPipelines endpoint by non-administrative users
- JWT tokens being used from unexpected IP addresses or user agents
- Ingestion-bot account activity that does not correlate with scheduled pipeline executions
- Unauthorized modifications to metadata, data sources, or service configurations
- Access to sample data or service metadata by users who should not have such permissions
Detection Strategies
- Monitor and log all requests to the /api/v1/ingestionPipelines endpoint with user attribution
- Implement anomaly detection for ingestion-bot authentication patterns
- Alert on any administrative actions performed using ingestion-bot credentials outside of expected automation windows
- Review access logs for read-only users accessing ingestion pipeline configuration endpoints
Monitoring Recommendations
- Enable detailed audit logging for all API endpoints in OpenMetadata
- Configure alerts for privilege escalation patterns or unexpected role assumption
- Monitor for data exfiltration indicators such as bulk sample data access
- Implement network-level monitoring for JWT token reuse from different source IPs
How to Mitigate CVE-2026-26010
Immediate Actions Required
- Upgrade OpenMetadata to version 1.11.8 or later immediately
- Rotate all JWT tokens and credentials used by ingestion-bot services
- Audit access logs to identify potential exploitation attempts
- Review any changes made by the ingestion-bot account for unauthorized modifications
- Temporarily restrict access to the /api/v1/ingestionPipelines endpoint if immediate patching is not possible
Patch Information
OpenMetadata has released version 1.11.8 which addresses this vulnerability. The fix ensures that sensitive JWT credentials are properly redacted from API responses, preventing unauthorized access to ingestion-bot tokens.
Organizations should upgrade to 1.11.8 by following the official upgrade documentation. The release is available on the OpenMetadata Release 1.11.8 page. Additional details about the vulnerability can be found in the GitHub Security Advisory GHSA-pqqf-7hxm-rj5r.
Workarounds
- Implement network-level access controls to restrict /api/v1/ingestionPipelines endpoint access to administrative users only
- Deploy a reverse proxy or API gateway to filter sensitive fields from API responses
- Reduce the number of users with authenticated access to OpenMetadata until patching is complete
- Monitor ingestion-bot activity closely and implement additional authentication factors where possible
- Consider temporarily disabling ingestion pipelines for highly sensitive data sources until the upgrade is applied
# Verify OpenMetadata version after upgrade
curl -s http://your-openmetadata-instance/api/v1/system/version | grep -o '"version":"[^"]*"'
# Expected output should show version 1.11.8 or higher
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
