CVE-2026-100373
- Source
- https://cve.org/CVERecord?id=CVE-2026-100373
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100373.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-100373
- Published
- 2026-09-25T19:38:29Z
- Modified
- 2026-09-27T08:03:01Z
- Severity
-
- 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N CVSS Calculator
- Summary
- OpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypass
- Details
-
OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses. Users permitted to create or update EventSubscription can set webhook destinations to internal hosts, allowing the server to send requests to private networks and cloud metadata endpoints while returning HTTP status codes that enable blind SSRF probing.
- Database specific
{ "cna_assigner": "VulnCheck", "cwe_ids": [ "CWE-918" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100373.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100373.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-100373
- https://www.vulncheck.com/advisories/openmetadata-through-2.0.2-ssrf-via-webhook-url-validation-bypass
- https://github.com/open-metadata/OpenMetadata/issues/32592
- https://github.com/open-metadata/OpenMetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f
- https://github.com/open-metadata/OpenMetadata
- https://github.com/open-metadata/OpenMetadata/blob/2.0.2-release/openmetadata-service/src/main/java/org/openmetadata/service/util/URLValidator.java#L34-L47
- https://gist.github.com/naif-alfardan/8a69e0648e11b07abe63f949346179c1
Affected packages
Git / github.com/open-metadata/openmetadata
Affected versions
0.*
0.3.0-SNAPSHOT.pre2
0.3.1-release
0.4.0-pre
0.8.1-release
1.*
1.0.0-alpha-release
2.*
2.0.0-release
2.0.1-release
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100373.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "213762854029979177739404779277064091814",
"length": 433
},
"id": "CVE-2026-100373-05c0bbbe",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/open-metadata/openmetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f",
"target": {
"file": "openmetadata-service/src/test/java/org/openmetadata/service/util/URLValidatorTest.java",
"function": "testValidOktaUrlsWithFdPrefix"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "245234600219637229797479000088944410786",
"length": 1230
},
"id": "CVE-2026-100373-07ad23f6",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/open-metadata/openmetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f",
"target": {
"file": "openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/EventSubscriptionRepository.java",
"function": "prepare"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"27086729661268477762015271624958525046",
"204136098907533642617500796065977289655",
"23649403435463546314767683309059999264",
"85719057484980074471977063143382693706",
"606846234722780355334305822287623680",
"115049733374336379438096632039901120170",
"153597686863226410231407472912846366710",
"271899601537154376715140797675229882008"
],
"threshold": 0.9
},
"id": "CVE-2026-100373-0878c757",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/open-metadata/openmetadata/commit/c49ec6b147d26597fe6053c55196583900954eef",
"target": {
"file": "openmetadata-service/src/main/java/org/openmetadata/service/resources/teams/UserResource.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "246752066142958455540932252998855884944",
"length": 646
},
"id": "CVE-2026-100373-109619c5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/open-metadata/openmetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f",
"target": {
"file": "openmetadata-service/src/main/java/org/openmetadata/service/util/URLValidator.java",
"function": "getString"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"206659064592655304266934833514394735278",
"250957408144592176886943147550622360328",
"293815006980222128714211520058554144844"
],
"threshold": 0.9
},
"id": "CVE-2026-100373-12562254",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/open-metadata/openmetadata/commit/c49ec6b147d26597fe6053c55196583900954eef",
"target": {
"file": "openmetadata-integration-tests/src/test/java/org/openmetadata/it/tests/TeamResourceIT.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "330685659248723131132688529809720424838",
"length": 204
},
"id": "CVE-2026-100373-1dc295de",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/open-metadata/openmetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f",
"target": {
"file": "openmetadata-service/src/main/java/org/openmetadata/service/util/OAuth2TokenManager.java",
"function": "createTokenClient"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "263377669603436759335553324185318720852",
"length": 1166
},
"id": "CVE-2026-100373-23889b98",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/open-metadata/openmetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f",
"target": {
"file": "openmetadata-service/src/main/java/org/openmetadata/service/notifications/recipients/context/WebhookRecipient.java",
"function": "prepareWebhookHeaders"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "326134398181710158534760590331136457800",
"length": 183
},
"id": "CVE-2026-100373-25b7ca55",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/open-metadata/openmetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f",
"target": {
"file": "openmetadata-service/src/test/java/org/openmetadata/service/util/URLValidatorTest.java",
"function": "testValidUrlsWithFe80Prefix"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"84817079006337622395132862047995018603",
"57216148311152517390888865160556006005",
"98511898744149946297469482622016032357",
"271607454676046304342262070314507658137",
"127540277617496582432707655360239512289",
"77712397602365739299614491403698029006",
"209806221192797972985554291521637881726",
"338253729618797817429008003247721807244",
"129017108713252964739935112729984567603",
"267831351467943716036496887727668244608",
"323218815316045101237970532100209962013",
"73713566700586155546529565998266538568",
"115475414500506309651706648310027949602",
"327570797362184766145484502495642590742"
],
"threshold": 0.9
},
"id": "CVE-2026-100373-3ac2aac7",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/open-metadata/openmetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f",
"target": {
"file": "openmetadata-service/src/main/java/org/openmetadata/service/governance/workflows/elements/nodes/automatedTask/sink/providers/WebhookSinkProvider.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "126665774669446218258172441761202481251",
"length": 320
},
"id": "CVE-2026-100373-3f13654d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/open-metadata/openmetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f",
"target": {
"file": "openmetadata-service/src/main/java/org/openmetadata/service/util/URLValidator.java",
"function": "validateURL"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"68941810052407531686011052637608407275",
"92687507438859249674130094723051925031",
"205806926680506058288560623088639675402",
"134710766371918712317344233300968667888",
"85670131555344302689300629107992806275",
"161537362992167707616192923736952588293",
"1077192490507513403392202581442563723",
"170799544502131160281933643677983838414",
"120807284221669369700396296670691283075",
"203716995887103619151616123828588392920",
"316675007401912400230009767002833007154",
"22696852090277985242269267400841701453",
"207026875082831538832290619795827481504",
"178905198892951466620551939414691840212",
"72783209754745574685450403450257747603"
],
"threshold": 0.9
},
"id": "CVE-2026-100373-40c9b614",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/open-metadata/openmetadata/commit/c49ec6b147d26597fe6053c55196583900954eef",
"target": {
"file": "openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/TeamRepository.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"142092233430647600448930191815652758707",
"250813024700673259019176390683036101878",
"333389482620139650392682567241972057632",
"50569958549847385734595276429679805589",
"331530254288900472156471950651841051559",
"286726121658293822510846729992479772978",
"196429255264954536264652953260441972438",
"9175824042681505449861936876334701917",
"106252650781924799351818929688388875831",
"127793590914743545864648093946443529467",
"176652370175382600737244094797202005666",
"29176116012043914558982535424495826329",
"33802454415290799085179086156769650828",
"125113416510142921124270256388966270826",
"203814167554679321034604480378353329614",
"335672029088100176950877008079754407864",
"20894679640577918860169078847355634067",
"24996893368976972420773430926688099872",
"146013484998426493466963216836938391050",
"286726121658293822510846729992479772978",
"196429255264954536264652953260441972438",
"9175824042681505449861936876334701917",
"106252650781924799351818929688388875831",
"127793590914743545864648093946443529467",
"176652370175382600737244094797202005666",
"320703064823971548150628730675210406132",
"132013535887195529921622192689285571810",
"276596568465768412147134396984825097452",
"327085921513349768370891486759305688398",
"184235737127595847146402571616501313058",
"30542646196646900441920677664065769121",
"158911212671077854343566630163654438262",
"286726121658293822510846729992479772978",
"196429255264954536264652953260441972438",
"9175824042681505449861936876334701917",
"106252650781924799351818929688388875831",
"127793590914743545864648093946443529467",
"176652370175382600737244094797202005666",
"320703064823971548150628730675210406132",
"132013535887195529921622192689285571810",
"271636701538438613270106571901847909130",
"91673640365212139619903688448530440094"
],
"threshold": 0.9
},
"id": "CVE-2026-100373-42b418ed",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/open-metadata/openmetadata/commit/c49ec6b147d26597fe6053c55196583900954eef",
"target": {
"file": "openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/CollectionDAO.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "227169219987099743284150768024984547684",
"length": 880
},
"id": "CVE-2026-100373-43ce66e4",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/open-metadata/openmetadata/commit/c49ec6b147d26597fe6053c55196583900954eef",
"target": {
"file": "openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/TeamRepository.java",
"function": "clearFields"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"298706272039382424556234821524747224630",
"191301281738289231831709372761189177786",
"208633128517194709533956901339554678570",
"27706983341860757372563641090371173784",
"165787700986095352284652065838570777158",
"335099419858754407170360987115509462172",
"298120280211420813032416476325120092721",
"330745742220244461825563546796403788373",
"87215708782002800818946043478671754839",
"253831230710301470509927646611181843743",
"256733461305024085405361632761811692054",
"190195546573746983916823459642212733750",
"201432836924036322006152391938519885550"
],
"threshold": 0.9
},
"id": "CVE-2026-100373-43ec33dd",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/open-metadata/openmetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f",
"target": {
"file": "openmetadata-integration-tests/src/test/java/org/openmetadata/it/tests/EventSubscriptionResourceIT.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"60456987439296282284750898995435844312",
"324310134981425867304848592097129310215",
"63490723485083341895432127856537034425"
],
"threshold": 0.9
},
"id": "CVE-2026-100373-50b6e199",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/open-metadata/openmetadata/commit/c49ec6b147d26597fe6053c55196583900954eef",
"target": {
"file": "openmetadata-integration-tests/src/test/java/org/openmetadata/it/tests/UserResourceIT.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "327244692093519430958232673276026592481",
"length": 610
},
"id": "CVE-2026-100373-52f69baf",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/open-metadata/openmetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f",
"target": {
"file": "openmetadata-service/src/main/java/org/openmetadata/service/util/SubscriptionUtil.java",
"function": "getClient"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"116010803277505559534938932427328114858",
"329140832283311136972107175528975790142",
"34960697648234611054171329807832082688",
"143458727424300375053204184752371290204"
],
"threshold": 0.9
},
"id": "CVE-2026-100373-59242d9a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/open-metadata/openmetadata/commit/c49ec6b147d26597fe6053c55196583900954eef",
"target": {
"file": "openmetadata-service/src/main/java/org/openmetadata/service/resources/teams/TeamResource.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"65269617104347762709539701896715558332",
"325568968937794529319118948676175983870",
"116279944345318808688487306904094610310",
"317029896641217308584137304835003637590",
"139021512345090412911096660886796044430",
"115319944485405786238400177505597620916",
"27915870714080411357981810349367969191",
"161108082944742600529772101398411745515",
"269294910162037163841223879657541835170",
"63906264315305523519609725545608644111",
"208010561447694068132474062622516575803",
"219404392458483119373135651108918940606",
"324579524756902014335859789044798948672",
"302694446543403665385114688682728631557",
"27665308636620894495976685610268107589",
"108946649850356900765469318071775355179",
"106910311288355728069301756966091641646",
"317604191197234546000512705618321092218",
"250319128974201767891826118643051100471",
"25363784520316091443166376675919743666",
"4702245881089611198593113082069582010",
"135581673031216397769828996031597868417",
"325466815412179646109087999173742222477",
"166014467726724000313698692814274147013",
"158834621071162247732381364821865061858",
"301501495241760003935938931332656701043",
"76633785209129905993444615613563515379",
"256161644574071494542766436218365846583",
"12541073387284190819596556981194286690",
"166464779519673171614214670911869223745",
"300850773675959233120175210091731737838",
"36635292031878999596961655486731146487",
"168252295944034788655889777880159144453",
"291329971588197041351621391476360332698",
"118855318370317143536256426468206833438",
"58277426930442763808379836813450124856",
"317014936185711330420294984972447745007",
"327074227785766813597310371929434047224",
"180473839538816439884733847553342446132",
"38050087332141229418535801677418023576",
"134708043969881812386120812776165415963",
"251907282045046001882752571371942373763",
"260866783435097582119363405643541616786",
"240248453229237359281245342279019525824",
"268388631299295408248357714359184077949",
"88479557855463612832356923583086955800"
],
"threshold": 0.9
},
"id": "CVE-2026-100373-65183f71",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/open-metadata/openmetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f",
"target": {
"file": "openmetadata-service/src/main/java/org/openmetadata/service/util/URLValidator.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"305349871248829253287992832288745232130",
"187603773377379323043181411808505234097",
"101172498521791462742357593433412898394",
"207723085997529946819987333340003129295",
"325973589158557421798991869517492643380",
"234954314444027298215048129852173121872",
"141065398111539429507493980962483059607",
"303556854997304674352770316339232451828",
"123389096012693851866752208392381334239",
"247864576893790199970122576272839109216",
"197248935999729691397569725017799770131",
"44424821603154837347863406889390877314",
"225028273753222631544851061983662502212",
"145885383986611151636859379269263273254",
"135555894338118974541477960165248621546",
"310054844568829377980736215716155891866",
"282426436572964263953235292889538686298",
"166259461287430853795976092329040817838",
"11820963409212512566337334531677643213",
"219559267500695709611764778973396826079",
"94159364704719246804616757140321039575",
"293299504085672080723652594059576158441",
"295759894348849960033551842598174735239",
"146495598906525010156884849194129740182",
"59713942044336755488868738180819862184",
"16733882180190904195531558150357793189",
"335312999361279413638205931673790033234",
"157491549431174606113296264682367157757",
"197970234858722324668040281997333700079",
"275823046215748305117997480095115815735",
"116973558496478733130277369859748569658",
"211613568310306060681226586129858315395",
"57741548887723388473500601840519804164",
"65854764836998978844586919627615355296",
"47851255923696913463737274875700882408",
"304513246462482731608525577222628739647",
"173708584266278219515962646430617559397",
"251078464055500460065853528433782146418",
"125685240937759853946027129376006419586",
"261239260493211193169654560915459764587",
"331771178333401814994051538733687682883",
"134063397847665907156548422063151153792",
"46356846036251072848911479798224939170",
"208049583919913588534396032863698880749",
"191544002547181867274998631561387928344",
"322702288992702353083021689534585785160",
"53586735722177830846343585047649870587",
"97315886779442222273362228608285770100",
"303655780705154111757521542687840102977",
"264458877336781722033122914112376268395",
"214968098434959256077726152544976308037",
"178008196159128365643080896388499010772",
"54738969873912842247479997882893519014",
"231881313129346674645074361083225820798"
],
"threshold": 0.9
},
"id": "CVE-2026-100373-6a67baa4",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/open-metadata/openmetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f",
"target": {
"file": "openmetadata-service/src/main/java/org/openmetadata/service/notifications/recipients/context/WebhookRecipient.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "61645079824222412010225877539264558689",
"length": 177
},
"id": "CVE-2026-100373-911bbbfe",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/open-metadata/openmetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f",
"target": {
"file": "openmetadata-service/src/test/java/org/openmetadata/service/util/URLValidatorTest.java",
"function": "testValidUrlsWithFcPrefix"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "84141832292751845180181685911337876104",
"length": 389
},
"id": "CVE-2026-100373-92e6c2ba",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/open-metadata/openmetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f",
"target": {
"file": "openmetadata-service/src/main/java/org/openmetadata/service/notifications/recipients/context/WebhookRecipient.java",
"function": "getConfiguredRequest"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"27498426787394654705195667230085504933",
"288450077357541818025478050823530529907",
"51714023375555246045912762471677370099",
"72119996489555970144583074971959034076",
"137673542148625678910754599037062772384",
"281615787747155368591375771407848518065",
"266393163027471204974470350579571070215",
"239024666697753674153236768217992623458",
"284706638841299981507710506821633647307",
"69266068615148447921962450048672103909",
"37431081178347564458304642625533381358",
"173924874751461867577535615472787158781",
"46356846036251072848911479798224939170",
"208049583919913588534396032863698880749",
"191544002547181867274998631561387928344",
"322702288992702353083021689534585785160",
"53586735722177830846343585047649870587",
"53798771086454027734981656864109249013",
"52001380662812304047196541341732533899",
"110855189424589589344629350726803779516",
"306360491072455963539120562996804878717",
"100815121741699249938973973452591601185",
"117621961059681868747669622648503607827",
"131065001302160702158338614864660567212",
"261044477279909484065370885307742134649",
"100327153640827719036331976136590517830",
"158349761369230816254501900830579959370",
"151072971597588605793084798043485793779"
],
"threshold": 0.9
},
"id": "CVE-2026-100373-95270b32",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/open-metadata/openmetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f",
"target": {
"file": "openmetadata-service/src/main/java/org/openmetadata/service/util/SubscriptionUtil.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"37170157611109733492975385055250927945",
"66268719618098379100660581316538426195",
"6863899479744562572381324209318841854",
"82749913860571042618639459781583929846",
"135654873876204830080191918210914108881",
"177165803504949913069452336373717292861",
"78646435622331846111070993496701778028",
"291304531375878924432321113085787433380",
"146423029920907509854455788213601021862",
"294471108277036000079679522691679772531",
"788147559843259588395174139693495925",
"169763493271363151630244337320398680759",
"185552020931870123240939032626656086064",
"119705769041798592581149414232582247750",
"31247209760838116216412741124507543247",
"148426459285397141740815108611953511970",
"130309312147474884935931544016241854333",
"198299201860082453028770477382026676950",
"310256650954083631524271221970226305793",
"119738655486924919136164383806709817950",
"323047321986354632241761503010899328891",
"107313950439022718172139499259929420666",
"154520456797207724653380842711685660560",
"238141156429813676373992363970504839286",
"172065273267011711571910772645649604216",
"316359291309111087579511205437545102741"
],
"threshold": 0.9
},
"id": "CVE-2026-100373-9891d627",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/open-metadata/openmetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f",
"target": {
"file": "openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/EventSubscriptionRepository.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "44786663155716850171828875738998856649",
"length": 2492
},
"id": "CVE-2026-100373-b399ef3f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/open-metadata/openmetadata/commit/c49ec6b147d26597fe6053c55196583900954eef",
"target": {
"file": "openmetadata-service/src/main/java/org/openmetadata/service/resources/teams/UserResource.java",
"function": "list"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "68026216543365984412607571681927388142",
"length": 1134
},
"id": "CVE-2026-100373-c1531ca5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/open-metadata/openmetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f",
"target": {
"file": "openmetadata-service/src/main/java/org/openmetadata/service/util/SubscriptionUtil.java",
"function": "prepareWebhookHeaders"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "110090743407361807385509345940629248551",
"length": 140
},
"id": "CVE-2026-100373-cb7a2e6d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/open-metadata/openmetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f",
"target": {
"file": "openmetadata-service/src/main/java/org/openmetadata/service/governance/workflows/elements/nodes/automatedTask/sink/providers/WebhookSinkProvider.java",
"function": "WebhookSinkProvider"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "35594385105974307550021359859527550499",
"length": 1098
},
"id": "CVE-2026-100373-cc56784f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/open-metadata/openmetadata/commit/c49ec6b147d26597fe6053c55196583900954eef",
"target": {
"file": "openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/TeamRepository.java",
"function": "setFields"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"95483403254855622225727803357962945924",
"116979595828706847777149703924046783499",
"272125836331255306195207118059969465667",
"65435488991521280683412022172870806052",
"322296974977157149582818145384281188659",
"194153606842880763741213813423316718367",
"56525060396065143753763343666041729866",
"103174944340774844694565834857985403280",
"199529121310824118598590215184761544181",
"111385133018748250807937075502837660483",
"238557466707409534110106255206612160408"
],
"threshold": 0.9
},
"id": "CVE-2026-100373-d939f907",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/open-metadata/openmetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f",
"target": {
"file": "openmetadata-service/src/main/java/org/openmetadata/service/util/OAuth2TokenManager.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "192087705570539774200794762195841673841",
"length": 367
},
"id": "CVE-2026-100373-e2029391",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/open-metadata/openmetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f",
"target": {
"file": "openmetadata-service/src/test/java/org/openmetadata/service/util/URLValidatorTest.java",
"function": "testValidPublicUrls"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"245641229681773074801220431663106262183",
"152582654937124335881923142730663398648",
"83156485334496559097800523594651354662",
"193493829584006667707886555047351866913",
"115220533114339627276168914828388778413",
"295796769964614082187218660713550744939",
"139385947756232184226587890582105000559",
"124998563296358052937485619763212133587",
"184059713610283409031568569300996847853",
"312368130618998436145479338388650217515",
"288285291380270476341225789398056266224",
"318726288420313281818713103448693466073",
"274989379086265097092400034492641187263",
"8595579254928788335197543498920660563",
"219903897520170215704476132537086302551",
"253953691825924397766478339532022185219",
"288448365699364149156419376234041677046",
"213386534381696180267362028963665961225",
"319464239458663765522352268085108040770",
"336045702489721483250317104178799504716",
"74006592445570480103062553099728368724",
"309178709451481133772155736465951774990",
"108543856603186922264430880870704575589",
"317633560991338245084877854376620372158",
"98684314186562738502255436922860176899",
"80431024209888126655678618495246574764",
"333821741712937984870855134039958122502",
"270318895105366514578396642737109044930",
"323922386298269486379725113172866026075",
"117993283799720428997167804234316102429",
"173634845716054515791076003120164954950",
"61085923533089864323520378685755405260",
"232338723259646315361941103773308548030",
"159934255454064530948873098600913421815",
"14580646959375362007583021144474727236",
"115915022894061974075203342215063874755"
],
"threshold": 0.9
},
"id": "CVE-2026-100373-f393765b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/open-metadata/openmetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f",
"target": {
"file": "openmetadata-service/src/test/java/org/openmetadata/service/util/URLValidatorTest.java"
}
}
]
vanir_signatures_modified
"2026-09-27T08:03:01Z"