CVE-2026-90772: Amundsen Frontend XSS Vulnerability

CVE-2026-90772 Overview

CVE-2026-90772 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Amundsen data discovery and metadata platform through version 4.3.0. The Amundsen frontend renders table, dashboard, and feature descriptions using React's dangerouslySetInnerHTML in ResourceListItem components without HTML sanitization. Attackers with the ability to write metadata can inject markup such as <img onerror> payloads into descriptions through the metadata service or Elasticsearch. Every user viewing search results executes the injected JavaScript in their browser session.

Critical Impact

Authenticated attackers can execute arbitrary JavaScript in the browsers of all Amundsen users who load search results, enabling session theft, credential harvesting, and lateral movement within the data catalog.

Affected Products

• Amundsen frontend versions through 4.3.0
• ResourceListItem/TableListItem component and related list item renderers
• Deployments ingesting descriptions from the Amundsen metadata service or Elasticsearch index

Discovery Timeline

• 2026-09-13 - CVE-2026-90772 published to the National Vulnerability Database (NVD)
• 2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90772

Vulnerability Analysis

Amundsen is an open-source data discovery platform that indexes tables, dashboards, and machine learning features across an organization. The frontend displays resource summaries, including user-supplied descriptions, in search result lists. In version 4.3.0 and earlier, the TableListItem and related components render these descriptions through React's dangerouslySetInnerHTML property.

React's dangerouslySetInnerHTML bypasses the framework's default HTML escaping. When developers use it without an HTML sanitizer such as DOMPurify, any markup contained in the source string is parsed and executed by the browser. Amundsen applies no such sanitization to description fields.

Because the payload is stored in the backing metadata service or Elasticsearch index, the injection persists across sessions and affects every user who searches or browses the catalog. The vulnerability requires low privileges to write metadata but impacts all viewers, including administrators.

Root Cause

The root cause is the direct rendering of untrusted metadata strings through dangerouslySetInnerHTML in frontend/amundsen_application/static/js/components/ResourceListItem/TableListItem/index.tsx and sibling list-item components. No sanitization pass is performed before injecting the string into the DOM.

Attack Vector

An attacker with permission to create or edit a table, dashboard, or feature description submits a description containing HTML markup with an executable event handler, for example an <img> tag with an onerror attribute that invokes JavaScript. Alternatively, an attacker with write access to Amundsen's Elasticsearch index can inject the payload directly. When any authenticated user runs a search or lists resources, the frontend renders the malicious description and executes the payload in that user's browser context, inheriting their Amundsen session and cookies.

No verified public exploit code is available. See the VulnCheck Advisory for Amundsen and GitHub Issue #2362 for additional technical context.

Detection Methods for CVE-2026-90772

Indicators of Compromise

• Description fields in the Amundsen metadata store or Elasticsearch index containing HTML tags such as <script>, <img>, <iframe>, <svg>, or event handler attributes like onerror, onload, and onclick.
• Outbound browser requests from Amundsen users to unexpected domains initiated while viewing search results or resource lists.
• Unusual session activity for Amundsen users shortly after viewing catalog pages, including token reuse from new IP addresses.

Detection Strategies

• Query the metadata backend and Elasticsearch description fields for regular expressions matching HTML tags or JavaScript event handlers.
• Enable and review browser Content Security Policy (CSP) violation reports from the Amundsen frontend origin.
• Inspect application access logs for PUT/POST requests to metadata description endpoints containing angle brackets or URL-encoded script payloads.

Monitoring Recommendations

• Alert on any metadata edit operation whose payload contains <script, onerror=, onload=, javascript:, or similar XSS primitives.
• Monitor authentication logs for concurrent sessions or geographically anomalous logins for accounts that recently accessed the Amundsen UI.
• Track egress traffic from workstations to domains not previously associated with Amundsen usage.

How to Mitigate CVE-2026-90772

Immediate Actions Required

• Restrict metadata write access to trusted service accounts and vetted users until a patched release is deployed.
• Audit existing table, dashboard, and feature descriptions for HTML markup and remove or escape any suspicious content.
• Rotate session cookies and API tokens for users who may have viewed malicious search results.
• Deploy a strict Content Security Policy on the Amundsen frontend that disallows inline scripts and untrusted script sources.

Patch Information

No fixed version is identified in the referenced advisory at the time of publication. Track the upstream Amundsen repository and GitHub Issue #2362 for a release that replaces dangerouslySetInnerHTML usage with a sanitized renderer such as DOMPurify or a plain-text component. Refer to the VulnCheck Advisory for Amundsen for updated fix guidance.

Workarounds

• Fork the frontend and replace dangerouslySetInnerHTML in ResourceListItem components with plain-text rendering or sanitized HTML via DOMPurify before rebuilding the container image.
• Place the Amundsen UI behind a reverse proxy that injects a restrictive Content Security Policy header, blocking inline scripts and third-party script origins.
• Sanitize existing descriptions in the metadata backend and Elasticsearch index by stripping HTML tags with a scheduled job.

# Example CSP header to mitigate reflected/stored XSS execution
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;