CVE-2026-46481

OpenMetadata is a unified metadata platform. Prior to version 1.12.4, a non-admin SSO user can trigger a TEST_CONNECTION workflow for a Database Service and receive, in the HTTP 201 response of POST /api/v1/automations/workflows, both the cleartext database password in request.connection.config.password and the ingestion bot JWT in openMetadataServerConnection.securityConfig.jwtToken. The leaked ingestion-bot token can then be reused as Authorization: Bearer <jwt> to access sensitive service APIs with bot-level privileges. This issue has been patched in version 1.12.4.

• CWE-201

• https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-9vmh-whc4-7phg
• https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-9vmh-whc4-7phg

Published

Jun 8, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-46476Flowise is a drag & drop user interface to build a customize…8.8
• CVE-2026-46477Flowise is a drag & drop user interface to build a customize…8.8
• CVE-2026-46478Flowise is a drag & drop user interface to build a customize…8.8
• CVE-2026-46479Flowise is a drag & drop user interface to build a customize…8.8
• CVE-2026-4648Use of an insecure cryptographic algorithm in the cashless p…6.8
• CVE-2026-46480Flowise is a drag & drop user interface to build a customize…8.8
• CVE-2026-46483Vim is an open source, command line text editor. Prior to 9.…7
• CVE-2026-46484Headplane is a feature-complete Web UI for Headscale. Prior …8.1
• CVE-2026-46485Dashy is a self-hostable personal dashboard. Prior to 4.0.8,…8.2
• CVE-2026-46486MVT (Mobile Verification Toolkit) helps with conducting fore…5.3
• CVE-2026-46489SolidInvoice is an open-source invoicing platform. Prior to …8.1
• CVE-2026-4649Apache Artemis before version 2.52.0 is affected by an authe…5.3