CVE-2026-81029 in OpenMetadata
Summary
by MITRE • 08/26/2026
OpenMetadata accepts a caller-supplied post-authentication redirect target and appends the issued token to it. SamlLoginServlet reads the callback request parameter and stores it in the HTTP session without comparing it against any configured or registered destination, and the assertion consumer servlet later formats that stored value into a URL carrying the freshly issued JWT together with the account's email and name before sending the redirect. The OIDC and OAuth2 handler follows the same pattern with its own redirect parameter and the issued identity token. A request naming a destination the attacker controls therefore causes the server to deliver a valid token for whoever completes the login to that destination. Because the token authenticates API calls as that account, a user who follows such a link and authenticates hands over control of their account. Version 2.0.0 removes the caller-supplied callback parameter; no 1.x release validates it.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability in OpenMetadata represents a critical authentication bypass mechanism rooted in improper validation of redirect targets following successful user authentication. Specifically, the SamlLoginServlet and OIDC/OAuth2 handlers accept a post-authentication redirect target supplied by the caller without performing any verification against an allowlist or registered destinations. This architectural flaw allows an attacker to specify arbitrary URLs as the destination for the login callback. Upon completion of the authentication process, the server retrieves this unvalidated parameter from the HTTP session and appends it with sensitive identity tokens, including JSON Web Tokens (JWT), along with account identifiers such as email and name. The resulting URL is then used to redirect the user's browser, effectively delivering valid credentials for the authenticated account directly to a destination controlled by the attacker.
From an operational perspective, this flaw enables severe account takeover scenarios. An attacker can craft a malicious link that directs a victim through the standard login flow but ultimately redirects them to a phishing site or server under their control. Once the victim authenticates, they unknowingly hand over full administrative access of their OpenMetadata account because the issued token is transmitted in clear text within the redirect URL parameters. This behavior violates fundamental security principles regarding session management and state transfer, as sensitive authentication artifacts are exposed through browser history, proxy logs, or referrer headers when redirected to external domains. The lack of validation means that any domain can be exploited, facilitating phishing attacks where users may inadvertently expose their credentials to malicious actors who then use the stolen tokens to impersonate them within the OpenMetadata platform.
This vulnerability aligns with CWE-601, which describes URL Redirection to Untrusted Site (Open Redirect), and more critically impacts authentication integrity in a manner consistent with CWE-287, Improper Authentication. In terms of offensive security frameworks, this behavior maps directly to MITRE ATT&CK technique T1534, specifically the sub-technique for Internal Phishing or External Phishing depending on the target domain, where attackers leverage legitimate authentication flows to harvest credentials and tokens. The exploitation relies heavily on social engineering to trick users into initiating the login process from a controlled entry point, after which the system's trust in user-supplied input leads to credential leakage.
Mitigation strategies must focus on strict validation of redirect parameters before they are used for post-authentication navigation. Developers should implement an allowlist approach where only pre-registered and trusted URIs can be accepted as callback targets. Alternatively, if dynamic redirection is required, the system should encode or hash the destination URL to prevent tampering while ensuring it cannot point to external domains unless explicitly permitted by policy. For users of OpenMetadata version 1.x, immediate patching to version 2.0.0 or later is essential, as this release removes the caller-supplied callback parameter entirely, thereby eliminating the attack vector at its source until a more robust validation mechanism can be implemented in future updates.