CVE-2026-100373

Name of the Vulnerable Software and Affected Versions OpenMetadata versions prior to 2.0.3

Description An issue exists in the URLValidator.validateURL() function where DNS hostnames are not properly resolved and internal addresses are not correctly validated. This allows users with permissions to create or update EventSubscription to configure webhook destinations pointing to internal hosts. Consequently, the server can be induced to send requests to private networks and cloud metadata endpoints, with the returned HTTP status codes facilitating blind Server-Side Request Forgery (SSRF) probing, a technique used to confirm the existence of internal services without seeing the direct response body.

Recommendations Update OpenMetadata to version 2.0.3 or later. Restrict the ability to create or update EventSubscription to trusted administrators only.