CVE-2026-81029: OpenMetadata Auth Bypass Vulnerability

CVE-2026-81029 Overview

CVE-2026-81029 is an open redirect vulnerability in OpenMetadata that leaks JSON Web Tokens (JWT) through unvalidated post-authentication callback parameters. The SamlLoginServlet reads a caller-supplied callback request parameter and stores it in the HTTP session without comparing it against a registered destination. The assertion consumer servlet later appends the issued JWT, account email, and account name to that URL before redirecting the browser. The OIDC and OAuth2 handler mirrors this behavior with its own redirect parameter and identity token. An attacker who tricks a user into following a crafted login link receives a valid token authenticating API calls as that account. This flaw is classified as CWE-601: URL Redirection to Untrusted Site.

Critical Impact
A successful attack yields a valid JWT that authenticates the OpenMetadata API as the victim, resulting in full account takeover of any user who completes login through a poisoned link.

Affected Products

OpenMetadata versions prior to 2.0.0
OpenMetadata SAML authentication handler (SamlLoginServlet)
OpenMetadata OIDC and OAuth2 authentication handlers

Discovery Timeline

2026-08-26 - CVE-2026-81029 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-81029

Vulnerability Analysis

OpenMetadata delegates post-login navigation to a caller-supplied URL. The SamlLoginServlet accepts a callback query parameter and persists it in the HTTP session unchanged. When the SAML assertion consumer completes the authentication flow, it formats the stored value into a redirect URL and appends the freshly minted JWT, the authenticated user's email, and their display name as parameters.

The OIDC and OAuth2 login handler follows the same design. It accepts its own redirect parameter and appends the issued identity token to whatever URL the caller requested. Neither handler validates the destination against an allowlist of registered relying-party URLs.

An attacker crafts a login URL where the redirect parameter points to an attacker-controlled host. When a legitimate user clicks the link and completes authentication, OpenMetadata sends the browser to the attacker's server with a valid JWT in the URL. The attacker's server logs the token from the request. That token then authenticates API calls as the victim until it expires.

Root Cause

The root cause is missing validation of a redirect target combined with placement of a bearer credential into that redirect URL. The servlet trusts input received before authentication and reuses it as a trusted sink after authentication issues a token.

Attack Vector

Exploitation requires network access to the OpenMetadata login endpoint and a victim who follows the crafted link and completes single sign-on. The attacker does not need existing credentials. The vulnerability is described in the VulnCheck Advisory for OpenMetadata and referenced source in GitHub SamlLoginServlet Source Code.

No verified proof-of-concept code is available. The vulnerability manifests through crafted query strings against the SAML and OIDC login servlets. See the GitHub Issue #29662 for reporter discussion.

Detection Methods for CVE-2026-81029

Indicators of Compromise

HTTP requests to OpenMetadata /api/v1/saml/login or OIDC login endpoints with callback or redirect parameters pointing to external hosts.
Outbound redirects from the OpenMetadata server carrying token=, email=, or name= query parameters to unexpected destinations.
Successful API authentication from IP addresses that never completed a browser login flow.

Detection Strategies

Parse OpenMetadata access logs for login callback parameters whose host does not match the configured OpenMetadata deployment domain.
Correlate JWT issuance events with the destination host of the subsequent HTTP 302 redirect and alert on mismatches.
Monitor for JWT use from user-agent strings or geolocations inconsistent with the account's normal authentication pattern.

Monitoring Recommendations

Forward OpenMetadata application logs and reverse-proxy access logs to a centralized logging platform for query and retention.
Alert on any HTTP 3xx response from OpenMetadata whose Location header references an external domain.
Track JWT reuse patterns and flag tokens presented from multiple distinct IP addresses within short intervals.

How to Mitigate CVE-2026-81029

Immediate Actions Required

Upgrade OpenMetadata to version 2.0.0, which removes the caller-supplied callback parameter entirely.
Rotate any JWT signing keys and invalidate active sessions to revoke tokens that may already have been captured.
Audit authentication logs for the past retention window to identify suspicious redirect destinations tied to account activity.

Patch Information

OpenMetadata 2.0.0 removes the caller-supplied callback parameter from the SAML and OIDC login flows. No 1.x release validates the parameter, so upgrading is the only supported fix. Track releases on the GitHub OpenMetadata Repository and refer to the VulnCheck Advisory for OpenMetadata for advisory details.

Workarounds

Place OpenMetadata behind a reverse proxy that strips or rewrites callback and OIDC redirect parameters on login requests.
Restrict access to the OpenMetadata login endpoints to trusted networks or VPN users until the upgrade is deployed.
Educate users to reach OpenMetadata only through bookmarked internal URLs and never through emailed login links.

bash

# Example NGINX rule to strip caller-supplied callback parameters
location /api/v1/saml/login {
    if ($arg_callback) { return 400; }
    proxy_pass http://openmetadata_backend;
}