Skip to content
Threat Feed

Vendor

OpenMetadata

1 brief RSS
high advisory

OpenMetadata TEST_CONNECTION Workflow Leaks JWT and Database Password

OpenMetadata version 1.12.1 is vulnerable to an information disclosure issue where a non-admin user can trigger a TEST_CONNECTION workflow for a Database Service and receive the cleartext database password and the ingestion bot JWT in the HTTP response, enabling privilege escalation.

openmetadata-service +1 openmetadata information-disclosure jwt-leak credential-access
2r 2t