CVE-2026-22244: OpenMetadata Remote Code Execution Vulnerability via FreeMarker Email Templates
Summary
CVE-2026-22244: OpenMetadata's Server-Side Template Injection (SSTI) in FreeMarker email templates leads to RCE. Affects org.open-metadata:platform versions < 1.11.4. Fixed in 1.11.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenMetadata is an open-source data management platform that facilitates data governance, metadata management, and data lineage tracking. It provides a user-friendly interface for managing data assets and integrates with various data sources. However, a critical vulnerability has been identified in version 1.11.2, where improper handling of FreeMarker email templates can lead to remote code execution (RCE). This vulnerability arises from the lack of security controls during template instantiation, allowing attackers to execute arbitrary code on the server.
Vulnerability Detail
The vulnerability is a Server-Side Template Injection (SSTI) in FreeMarker email templates used by OpenMetadata. It originates from unsafe template instantiation in the DefaultTemplateProvider class, where user-controlled content from the database is rendered without proper validation or security restrictions. Attackers can exploit this by modifying email templates through the API, leading to RCE when the templates are processed. The potential ramifications include unauthorized access to sensitive data, system compromise, and data exfiltration.
How To Fix
Latest published version: 2.0.6 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.11.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the email template modification API for non-admin users to prevent unauthorized changes until the package is updated. Additionally, consider implementing input validation for templates stored in the database.
Conclusion
The OpenMetadata vulnerability CVE-2026-22244 poses a critical risk due to improper handling of FreeMarker email templates, allowing for remote code execution. Immediate action is required to update the package and implement security measures to protect against potential exploitation.
See every vulnerability recorded for org.open-metadata:platform →
FAQ
The CVSS score of this vulnerability is 9.1, indicating a critical severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring signup.
The vulnerability can lead to unauthorized access to sensitive data, system compromise, and data exfiltration, posing significant risks to confidentiality, integrity, and availability.
Yes, a patch is available in version 1.11.4 of OpenMetadata. It is recommended to update to this version to mitigate the vulnerability.
If immediate updates are not possible, restrict access to the email template modification API for non-admin users and implement input validation for templates in the database as a temporary measure.
