CVE-2026-22244

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-22244
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22244.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-22244
Aliases
Published
2026-01-08T15:12:51Z
Modified
2026-09-02T08:09:26Z
Severity
  • 8.5 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P CVSS Calculator
Summary
OpenMetadata Server-Side Template Injection (SSTI) in FreeMarker email templates that leads to RCE
Details

OpenMetadata is a unified metadata platform. Versions 1.5.0 through 1.11.3 are vulnerable to remote code execution via Server-Side Template Injection (SSTI) in FreeMarker email templates. An attacker must have administrative privileges to exploit the vulnerability. Version 1.11.4 contains a patch.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-1336"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22244.json"
}
References

Affected packages

Git / github.com/open-metadata/openmetadata

Affected ranges

Type
GIT
Repo
https://github.com/open-metadata/openmetadata
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
adbe4431db9c861987bca681a156cb5062df0c84
Fixed
bffe7c45807763f9b682021d4211c478d2a08bb3
Fixed
d17d13cee87db139e5d8f778547174f8ee341108
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:open-metadata:openmetadata:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.11.4"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.3.0-SNAPSHOT.pre2
0.3.1-release
0.4.0-pre
0.8.1-release
1.*
1.0.0-alpha-release
1.11.0-release
1.11.1-release
1.11.2-release
1.11.3-release

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22244.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "51834898959253789355240757164876697339",
                "270273916587880431979287235350556209338",
                "16054123665087782559531887014602331552"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-22244-0adbf009",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/open-metadata/openmetadata/commit/adbe4431db9c861987bca681a156cb5062df0c84",
        "target": {
            "file": "openmetadata-service/src/main/java/org/openmetadata/service/migration/postgres/v1110/Migration.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "8388154987470262310528445150254650542",
            "length": 826
        },
        "id": "CVE-2026-22244-0bfae92e",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/open-metadata/openmetadata/commit/adbe4431db9c861987bca681a156cb5062df0c84",
        "target": {
            "file": "openmetadata-service/src/main/java/org/openmetadata/service/migration/utils/v1110/MigrationUtil.java",
            "function": "insertV000RecordIfMissing"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "256775582256598110854758772218372841247",
            "length": 102
        },
        "id": "CVE-2026-22244-13c3f74c",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108",
        "target": {
            "file": "openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/DocumentRepository.java",
            "function": "entitySpecificUpdate"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "51834898959253789355240757164876697339",
                "270273916587880431979287235350556209338",
                "16054123665087782559531887014602331552"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-22244-16a92a53",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/open-metadata/openmetadata/commit/adbe4431db9c861987bca681a156cb5062df0c84",
        "target": {
            "file": "openmetadata-service/src/main/java/org/openmetadata/service/migration/mysql/v1110/Migration.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "123238065180946451469122173811773356066",
            "length": 203
        },
        "id": "CVE-2026-22244-16b8504d",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108",
        "target": {
            "file": "openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/DocumentRepository.java",
            "function": "DocumentRepository"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "242911513198465048023009136950060526305",
            "length": 203
        },
        "id": "CVE-2026-22244-183866c1",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108",
        "target": {
            "file": "openmetadata-service/src/main/java/org/openmetadata/service/resources/docstore/DocStoreResource.java",
            "function": "create"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "4309299065380164269141020178352091165",
            "length": 203
        },
        "id": "CVE-2026-22244-2754a96b",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/open-metadata/openmetadata/commit/adbe4431db9c861987bca681a156cb5062df0c84",
        "target": {
            "file": "openmetadata-service/src/main/java/org/openmetadata/service/migration/api/MigrationWorkflow.java",
            "function": "loadMigrations"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "274403152672102532820749256470603627113",
                "125804750498863329579726628595555022254",
                "327680533503687973912760099289403126613",
                "161183079062693704711373029668924173171",
                "299023090698485472738986961269560662453",
                "206600197392932027480406347676760366889",
                "178169158366002263596559723945817845778",
                "176181297913986154742139509663263700309",
                "253509284608853935647689192301123392177",
                "163842115911990394758259730067146238859",
                "240069760858377770995727579494592118275",
                "121397403255219254235660765182390897484",
                "314649066354364327391341581173025091204",
                "257304289810874693253314518335514523198",
                "182087859235814904497977234005718357927",
                "193309489743476241620327138575388081289",
                "320317715053747496413047574185810923425",
                "25079416429074776176749338234019769382",
                "285007537731821353614621310371800349176",
                "297090764725602147806602518550208119117",
                "38379138630809402290604679648029282893",
                "133014582456143084319275753380150835200",
                "328176796057398914426655392443808693401",
                "262301811224793089502595475832831041948"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-22244-2af7c435",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108",
        "target": {
            "file": "openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/DocumentRepository.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "116558112186239186515427689559496331596",
            "length": 633
        },
        "id": "CVE-2026-22244-2f6441dd",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108",
        "target": {
            "file": "openmetadata-service/src/main/java/org/openmetadata/service/util/EmailUtil.java",
            "function": "sendEmailVerification"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "24100414270304800662238845985442255859",
            "length": 67
        },
        "id": "CVE-2026-22244-2fcb26ec",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/open-metadata/openmetadata/commit/adbe4431db9c861987bca681a156cb5062df0c84",
        "target": {
            "file": "openmetadata-service/src/main/java/org/openmetadata/service/migration/postgres/v1110/Migration.java",
            "function": "runDataMigration"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "78837950822964951051698073906247053724",
            "length": 855
        },
        "id": "CVE-2026-22244-3d4ce33d",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/open-metadata/openmetadata/commit/adbe4431db9c861987bca681a156cb5062df0c84",
        "target": {
            "file": "openmetadata-service/src/main/java/org/openmetadata/service/migration/api/MigrationProcessImpl.java",
            "function": "performSqlExecutionAndUpdate"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "207353529307531116374155435662880313209",
                "8347472063486688851304595505580775936",
                "159558494117612632381898256593444304252",
                "140803849387440476196472558068414246068",
                "54809524354804301556346442897086171574",
                "114361491244056298469316227474401899496",
                "72960051209501277609131411650708134484",
                "254918490099152812517957068554686834333",
                "339629857818599115936950869465698742007",
                "141569642021618104411584849649249438752",
                "169359039232940737125554568768356925475",
                "213087554598934754004788646431984768553",
                "93262996845657224280897757484717895343",
                "327020239812410591517676109234502900828",
                "164804446338975010974002259271708944295",
                "147272635611308764091589484640694008382",
                "29454867516751228872241007287945405754"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-22244-3f8e4ada",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/open-metadata/openmetadata/commit/adbe4431db9c861987bca681a156cb5062df0c84",
        "target": {
            "file": "openmetadata-service/src/main/java/org/openmetadata/service/migration/api/MigrationWorkflow.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "66206583040044076972708118242157555820",
                "136276039634073277601854266903756671949",
                "184959558505018931387251751202034164303",
                "146606857118698974804471992174221966964"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-22244-417d7c5b",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/open-metadata/openmetadata/commit/adbe4431db9c861987bca681a156cb5062df0c84",
        "target": {
            "file": "openmetadata-service/src/main/java/org/openmetadata/service/migration/api/MigrationProcessImpl.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "20157155375128964130026463121927470812",
                "158810969304065356524193819584090783972",
                "16628874305183629423339879483385371028"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-22244-457838c3",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108",
        "target": {
            "file": "openmetadata-service/src/main/java/org/openmetadata/service/exception/CustomExceptionMessage.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "184781954191953452234709338824485818938",
                "318738652501132804647908312649599614582",
                "213489283073041135745960203851935829914"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-22244-4e6451d5",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108",
        "target": {
            "file": "openmetadata-spec/src/main/java/org/openmetadata/sdk/exception/WebServiceException.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "186749276589415073694622333538847671233",
                "72182092603732326249792671194477524063",
                "129744141310530841934288459109771427580",
                "159590328152054559829582198212868456585",
                "189534995892347510360689399681786760432",
                "225609928886211143411781715568215582162",
                "133971864352803140269285819736681661234",
                "42478285113421288543388581660603644556",
                "44208947112704584349062129877211672326",
                "323736921377732912559847417515788458092",
                "974227313492683926586773158838464503",
                "102420185576416875717864593301291666890",
                "107758515652642563229464590303452132707",
                "107831555655604408567815386309812987060",
                "293436087713326945367984676876036559741",
                "63870959685841192745441280957294829646",
                "175950693461854230591873192459510893878",
                "24648063255535538017620978920269859087",
                "293436087713326945367984676876036559741",
                "330579201060881161299347847113687991411",
                "255750026286594093549164766290593624226",
                "26346625926572478845346747385285795950",
                "33063098248326686574384308456820098382",
                "110838915355366019150585053244256023014",
                "293197796239042156199169666975366276288",
                "224505197725087543229966359913666711026",
                "175389616295686278817132825976197423262",
                "15957786157295543487639689092750649824",
                "302576463789042764872474587378808369348",
                "235281362467979008235179187131410201143"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-22244-55914509",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108",
        "target": {
            "file": "openmetadata-service/src/main/java/org/openmetadata/service/resources/docstore/DocStoreResource.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "257729383463098148854990077890008133734",
            "length": 223
        },
        "id": "CVE-2026-22244-5abde696",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108",
        "target": {
            "file": "openmetadata-service/src/main/java/org/openmetadata/service/util/EmailUtil.java",
            "function": "EmailUtil"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "51454448378862580560670373538269667838",
            "length": 980
        },
        "id": "CVE-2026-22244-5be7749e",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108",
        "target": {
            "file": "openmetadata-service/src/main/java/org/openmetadata/service/security/auth/BasicAuthenticator.java",
            "function": "sendInviteMailToUser"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "314013167972458661612259257987131502801",
            "length": 1790
        },
        "id": "CVE-2026-22244-5eca3d58",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/open-metadata/openmetadata/commit/adbe4431db9c861987bca681a156cb5062df0c84",
        "target": {
            "file": "openmetadata-service/src/main/java/org/openmetadata/service/migration/utils/v1110/MigrationUtil.java",
            "function": "migrateFlywayHistoryRecords"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "151398521940820146527991243814129709745",
            "length": 802
        },
        "id": "CVE-2026-22244-5f9ca6e7",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108",
        "target": {
            "file": "openmetadata-service/src/main/java/org/openmetadata/service/util/EmailUtil.java",
            "function": "sendDataInsightEmailNotificationToUser"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "263034774649467486083348788116743059653",
                "26694146831982981463233162588079326126",
                "164114708910570692833526202186429610656",
                "135179906226622226602580437950906921119",
                "47620606743188983164542039640458844366",
                "7490531088299127424188588469455333594",
                "171659225301704581108707667388785406543",
                "183336846716535185873902157589694057905",
                "29720707678567821239634236755975246472",
                "337318102263474637034845737032979538427",
                "6333675949441205495968777425825878650",
                "242935012226009128781851256794063823763",
                "49077968936918552143204448117110785490",
                "27911255162680712524234893856095824798",
                "7978250544121014416937307873747277732",
                "278438418702398007376498032469616448184",
                "291967745788647443477603919622401582698",
                "32216555657319396378252383475938239203",
                "206434362133358269210655664074728891506",
                "190137704034068206438947978511418749855",
                "170071981424391471394202634862522132724",
                "325450094248382101968003936622818685994",
                "48780927097624716295579590012487334448",
                "236560292514394566619781414035476758078",
                "253323734763999334805393697358573520067",
                "308126660361909269658612980588915428217",
                "71139670391408073593606811427839788757",
                "179923696751220145370520606676101448640",
                "150712469435353400758808001743331770336",
                "313295462114999611790562329486036623560",
                "1135679505602380279558043271476631127",
                "319195493461826326407190245879140776728",
                "337844419305460860430571129094525587407",
                "26907537561891828421602553394737889978",
                "268250921718114215299779657544767171361",
                "151529634944774549021587653259332877073",
                "337149389804445779834409614254324477137",
                "331505923517612488536828011341788936906",
                "167840017667244928777329450391693248272",
                "169394068199654799413258174692975058662",
                "234069503583784453445312280492740666326",
                "71517987585109355329978515558645179287",
                "2151628412349247330739671866215131277",
                "36789889030533079108984960938897190181",
                "231179500903528625589494788804093060653",
                "162116027341237534677292380799896684411",
                "105867800762833111435977615475044463668",
                "208492006063250445692204919994080849831",
                "335440769261153575635681420058624619780",
                "142799093993942872918408031978207409112",
                "276129659123186851847479559806039623048",
                "39904562136174914413536115057228766027",
                "78259969876328158455211896573530743776",
                "312536786177441095986150702982562080565",
                "219570133755676389380646484731437104963",
                "89197958030377397984759954043962059659",
                "249349251504257824496049540768191448411",
                "270930406030361619765213055821358960350",
                "313532083803927618456372637662047118781",
                "6438988035799947866565399168209978979",
                "247700329127639037642889018213018273445",
                "115860689479914307046237853389184639117",
                "167574350993218047310534056415848978788",
                "312006287520221900116538629119057861465",
                "129484502456493433060742815471499444138",
                "170602358885518100673606113411787108251",
                "184913998180262569520652070163830498727",
                "73349224276522383264257288753402379008",
                "317692099105293055848803634927470522957",
                "68704736587117805690801667090105144900",
                "225674515583245092335031456877636942097",
                "232609619842707200964548243535653987119",
                "14287085460756679486312006095464145112",
                "153964708810619891612680889884529374828",
                "321405178135311407981943091846250880605",
                "212526005185253654443259765899328895326",
                "274513287868873073735924969803798548877",
                "229892153255339717230388140392997509000",
                "88506729149077360143809871046003221221",
                "105456509879979942329812515921916803688",
                "50921442414464486983916447314738347647",
                "302725685127938217150177306866833933707",
                "8538584699806074123148504060041464085",
                "303010436180909834016442119203941809863",
                "264896992100909652674752822387998765754",
                "315455887208807988684224822979344492821",
                "44589070317451857837154771250476502471",
                "25252666002557636178480799891215351239",
                "133079927061491802508429884539708745600",
                "268629462467409739245746671253236674094",
                "100498991748652724983268465047471697769",
                "280468523521945671465835305186973806537",
                "264869074921128263215113237563890829829",
                "50921442414464486983916447314738347647",
                "302725685127938217150177306866833933707",
                "8538584699806074123148504060041464085",
                "74727404516363114792042438231321614593",
                "128467656667400870018926646784688880022",
                "138168418101904839460226289422389402254",
                "334569549745358757082966470574567416643",
                "148445946031476683583693435937734092874",
                "81292583525695440468434118776689676947",
                "149128613034391798978523692075528904995",
                "305615134876781273662622025870048504883",
                "12839159783786232693975341270126724263",
                "190287341836011323215375220368998403426",
                "119149608336972283082195088149719987075",
                "258897092107040878586446388888024882840",
                "91232933336119822357485371073650246423",
                "951019587296601368315993795719944568",
                "301684538420459831081978282663937269048",
                "317984145147466559937202088833779685311",
                "152219627144058995827203400843940919366",
                "100926629284107493182282246283032043038",
                "133018611461407433225379726749950288695",
                "35941140582361404229869028261059792036",
                "1986446483851705423342784016042292569",
                "157275149550922996344917701739761175422",
                "249680738612387215554959060485098055235"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-22244-61e46f71",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108",
        "target": {
            "file": "openmetadata-service/src/main/java/org/openmetadata/service/util/EmailUtil.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "24100414270304800662238845985442255859",
            "length": 67
        },
        "id": "CVE-2026-22244-72cc245e",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/open-metadata/openmetadata/commit/adbe4431db9c861987bca681a156cb5062df0c84",
        "target": {
            "file": "openmetadata-service/src/main/java/org/openmetadata/service/migration/mysql/v1110/Migration.java",
            "function": "runDataMigration"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "240927292497139243550539556926875257427",
                "236083535722517413404361104471625191579",
                "285246389518818337155330987707111680725",
                "19236571376059611114677786226710729004",
                "257852425461716388490577431244494757965",
                "10175428098173681804752365517326537478",
                "182623759393790951107300073776969236405",
                "264281481924956294767354196120516536332",
                "322173311019363125030408755576663574329",
                "60891068092622499809161608980193226357",
                "92943081314547839519994155914845094603",
                "42412005904802213185269323312139730164",
                "108371842925045757570382949070884771002",
                "157228990274573023969676644937199827930",
                "148630918822239083387583413125175394685",
                "317244424160462480583185919142127948246",
                "75777719177087444282024479111406258497",
                "252657252518148251842585201441547240828",
                "69601083085642564224613698895565592387",
                "254684364980701005087609007984122593681",
                "150337710644527522701880851252226263600",
                "114400568567317511824761610825848784866",
                "335959313404904035930139521398879781902",
                "121973011742480545373360940179813641295",
                "118016694559041298827350257272304277688",
                "160210155579523211082298482772909304010"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-22244-7defb7dd",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108",
        "target": {
            "file": "openmetadata-service/src/test/java/org/openmetadata/service/resources/docstore/DocStoreResourceTest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "155327307286469658475758209751431147338",
            "length": 642
        },
        "id": "CVE-2026-22244-8493af3b",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108",
        "target": {
            "file": "openmetadata-service/src/main/java/org/openmetadata/service/util/EmailUtil.java",
            "function": "sendPasswordResetLink"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "218534713373101076644839141874390985474",
            "length": 866
        },
        "id": "CVE-2026-22244-8539ed01",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108",
        "target": {
            "file": "openmetadata-service/src/main/java/org/openmetadata/service/util/EmailUtil.java",
            "function": "sendInviteMailToAdmin"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "174250918126137582912273954197403590407",
            "length": 621
        },
        "id": "CVE-2026-22244-996a9142",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108",
        "target": {
            "file": "openmetadata-service/src/main/java/org/openmetadata/service/util/EmailUtil.java",
            "function": "sendMailToMultiple"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "148386087734865396118622697052228601470",
                "247753924226171952643177967719877476169",
                "84366447983357170152446443023054460279",
                "20471808833037620582276213183994287270",
                "127654607866139121475909995453103169083",
                "73853675552554058735158054711240345710",
                "68757503621053631143699742475603455425",
                "74308725997918843773242453844637420778",
                "311651507842724901405285484751715556738",
                "319390332561128587812777651330712112425"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-22244-9d8cf272",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/open-metadata/openmetadata/commit/adbe4431db9c861987bca681a156cb5062df0c84",
        "target": {
            "file": "openmetadata-service/src/main/java/org/openmetadata/service/migration/utils/v1114/MigrationUtil.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "104386464269409187965275772607396860827",
            "length": 890
        },
        "id": "CVE-2026-22244-a428966e",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108",
        "target": {
            "file": "openmetadata-service/src/main/java/org/openmetadata/service/util/EmailUtil.java",
            "function": "sendTaskAssignmentNotificationToUser"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "240254387474116891503376894254177650905",
            "length": 626
        },
        "id": "CVE-2026-22244-a64fb6d8",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108",
        "target": {
            "file": "openmetadata-service/src/main/java/org/openmetadata/service/util/EmailUtil.java",
            "function": "sendAccountStatus"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "263050091243367412035407688944336014740",
            "length": 532
        },
        "id": "CVE-2026-22244-aaa9459c",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108",
        "target": {
            "file": "openmetadata-service/src/main/java/org/openmetadata/service/util/EmailUtil.java",
            "function": "sendTestEmail"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "268178942050171612104363801072151137427",
            "length": 887
        },
        "id": "CVE-2026-22244-ae46ee8e",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108",
        "target": {
            "file": "openmetadata-service/src/main/java/org/openmetadata/service/util/EmailUtil.java",
            "function": "sendChangeEventMail"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "68716287472831296899750015177699462292",
                "268341032679781111251555183748625483545",
                "219926343986811918319122201641128781124",
                "246249721355207125858555596365064380046",
                "13860908945162995646899491943270544634",
                "339145792198720485603658993028724950239",
                "261313096008110567320528498720542900600",
                "327440000111412121252142477080586951532",
                "285166563845716364110760873285970917150",
                "256881461787249913608667622390785166308",
                "328670520881604060141115119107846243724",
                "188782032522861787778474969720024050013",
                "141057140995643092308493051404868380009",
                "95998712295120759027143875604856203707",
                "42588412192914000175325225237829246481",
                "297168827576546284572423898614606805732",
                "202643702559483305718463532958738277311",
                "122300469108299112847469157192060490078",
                "322430747429928988968920077819267674731",
                "258887493420613319562000414108862630874",
                "310054494121263785360709305883865110249",
                "313200555570402078514832923746765967701",
                "71201372745114131925943048661877814418",
                "82990646233078223755891749426961499728",
                "167162617226200594620084625772385929105",
                "219539866824754635492757792740725652346",
                "45825425849304619331697054934508138354",
                "107538167045146554568083078193644424688",
                "39837992327610440400280976625141047195",
                "78521297348304461992829096172695346291",
                "142532480254153117743438400504156900540",
                "106219990706570736915725466397568615850",
                "166382334914725419496446183774228027983",
                "166278358800975348676778756164541175936",
                "65288599983567825992316911066307873107",
                "287341221951005777776244039251988136099",
                "46699937900460366108966137725330478006",
                "248785616558447593728431156257321161487",
                "19900085459757486688408294745489671504",
                "146858738701739336872262570829171609737",
                "111256160525847768419551218683828807912",
                "332190830292397749122666272660086785931",
                "185773361026420993376374368739089459584",
                "284761129750209118337809603962895584594",
                "197772140852062371296219292849534432351",
                "101651537243975360854997034813101453744",
                "25710384488708518540098364654328221125",
                "38956896895390641105643509603515867787",
                "137797281769059287621964436677058416302",
                "50664716750112846062436396424060359917",
                "135400638045937149055123582457978233859",
                "239528223042771930430907811164239175479",
                "317624163556517505185628813144739706894",
                "65459303014943262653305594739263392410",
                "31585064015196463234898656816757083996",
                "57681192182648121225023134664864605292",
                "318865885125820445215541310149555858376",
                "177829977784505587789890588225866170221",
                "152868930654041742249034385487566447584",
                "118228527867578039643451141748309562419",
                "303774551290534305734549651817131018515",
                "165973629264958259176556682627881644851",
                "316487385851671076857045725535982431343",
                "118957982589049358367339265450262171216"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-22244-b21f7a9c",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/open-metadata/openmetadata/commit/adbe4431db9c861987bca681a156cb5062df0c84",
        "target": {
            "file": "openmetadata-service/src/main/java/org/openmetadata/service/migration/utils/v1110/MigrationUtil.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "129563673631605485691696809390090125404",
                "76258668123272534527094403198501953462",
                "172603327682428392174674568029599873571"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-22244-b8b2f274",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/open-metadata/openmetadata/commit/adbe4431db9c861987bca681a156cb5062df0c84",
        "target": {
            "file": "openmetadata-service/src/main/java/org/openmetadata/service/util/OpenMetadataOperations.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "20303503210009068736088909140385487685",
            "length": 787
        },
        "id": "CVE-2026-22244-bc26e203",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/open-metadata/openmetadata/commit/adbe4431db9c861987bca681a156cb5062df0c84",
        "target": {
            "file": "openmetadata-service/src/main/java/org/openmetadata/service/migration/utils/v1110/MigrationUtil.java",
            "function": "migrateFlywayHistory"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "242911513198465048023009136950060526305",
            "length": 203
        },
        "id": "CVE-2026-22244-bfb77cdf",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108",
        "target": {
            "file": "openmetadata-service/src/main/java/org/openmetadata/service/resources/docstore/DocStoreResource.java",
            "function": "createOrUpdate"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "64296000783816469868838673352525043901",
            "length": 706
        },
        "id": "CVE-2026-22244-c24e6e92",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/open-metadata/openmetadata/commit/adbe4431db9c861987bca681a156cb5062df0c84",
        "target": {
            "file": "openmetadata-service/src/main/java/org/openmetadata/service/migration/utils/v1110/MigrationUtil.java",
            "function": "hasFlywayDataAlreadyMigrated"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "16257202221513505389423484831779964495",
            "length": 221
        },
        "id": "CVE-2026-22244-cd022235",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108",
        "target": {
            "file": "openmetadata-service/src/main/java/org/openmetadata/service/resources/docstore/DocStoreResource.java",
            "function": "getDocument"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "73411552044433681774430299939123334305",
                "82787347445451815817508358048446412866",
                "18644257938137096310868841129498127882",
                "225770125109626882072319817822366773696"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-22244-cdb5aa76",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108",
        "target": {
            "file": "openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/CollectionDAO.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "106079640487777423674096768531737662947",
            "length": 700
        },
        "id": "CVE-2026-22244-d4a99674",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108",
        "target": {
            "file": "openmetadata-service/src/main/java/org/openmetadata/service/util/EmailUtil.java",
            "function": "sendMail"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "16057735202447782873848837382374913442",
                "106919313075444140771943491026536628731",
                "15490053963704307366859252629300841972",
                "42581572648433087716617675176404863903",
                "128467656667400870018926646784688880022",
                "138168418101904839460226289422389402254",
                "325490253200926897423580084492910846065",
                "161197307212147348733354851224129107737",
                "278463695025569610539365413328522018471"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-22244-da74e965",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108",
        "target": {
            "file": "openmetadata-service/src/main/java/org/openmetadata/service/security/auth/BasicAuthenticator.java"
        }
    }
]
vanir_signatures_modified 
"2026-09-02T08:09:26Z"