Authentication Token Theft via OpenMetadata Redirect Vulnerability

OpenMetadata versions prior to 2.0.0 suffer from an insecure redirect vulnerability (CVE-2026-81029) within the SamlLoginServlet, OIDC, and OAuth2 handlers. The application fails to validate the callback request parameter before storing it in the user's HTTP session. Upon successful authentication, the server automatically appends a valid JWT - along with the user's email and name - to this attacker-supplied destination URL and performs a redirect. This flaw allows an unauthenticated attacker to craft a malicious link that, when clicked and authorized by an unsuspecting user, exfiltrates the user's session token to an external server. Once the attacker obtains this JWT, they can impersonate the victim, performing unauthorized API calls with the victim's privileges. This vulnerability impacts all 1.x releases and requires immediate remediation by upgrading to version 2.0.0 or later.

Impact

Successful exploitation results in full account takeover for the affected user. By obtaining a valid JWT, an attacker gains persistent unauthorized access to the victim's OpenMetadata account. This poses a significant risk to data integrity and confidentiality, particularly in environments where OpenMetadata integrates with sensitive organizational data stores. The number of potentially affected organizations is high, given the widespread use of OpenMetadata as an enterprise data catalog.

Recommendation

• Upgrade OpenMetadata instances to version 2.0.0 or later immediately to remove the vulnerable caller-supplied callback parameter logic.
• Audit web server access logs for anomalous outgoing redirects or suspicious outbound traffic patterns originating from the OpenMetadata server to unknown or unauthorized external domains.
• Implement egress filtering at the network level to restrict the OpenMetadata server from initiating connections to untrusted external domains.
• Review all active sessions and rotate credentials for accounts identified in recent logs that match the suspicious redirect pattern.