CVE-2026-26010: 
Java vulnerability analysis and mitigation

CVE-2026-26010 is a JWT token leakage vulnerability in OpenMetadata titled "Leaky JWTs in OpenMetadata exposing highly-privileged bot users." Prior to version 1.11.8, API calls issued by the UI against the /api/v1/ingestionPipelines endpoint expose JSON Web Tokens (JWTs) used by the ingestion-bot service account for certain data services including AWS Glue, Redshift, and Postgres. Any authenticated read-only user can retrieve these tokens and impersonate the highly privileged Ingestion Bot Role. The vulnerability was published on February 11, 2026, and fixed in OpenMetadata 1.11.8. It carries a CVSS v3.1 base score of 7.6 (High) (GitHub Advisory, OpenMetadata Advisory).

The root cause is classified as CWE-269 (Improper Privilege Management): the /api/v1/ingestionPipelines API endpoint returns the full jwtToken field in its response payload without filtering based on the requesting user's privilege level. Because the UI calls this endpoint during normal navigation (e.g., visiting the Services page), any authenticated user — including those with only read-only access — can observe the JWT in network traffic via browser developer tools. No special tooling or elevated access is required beyond a valid low-privilege account. The proposed remediation from the reporter includes redacting jwtToken from API responses for non-admin users and implementing role-based filtering so only users with explicit admin or service account permissions receive the token (GitHub Advisory, OpenMetadata Advisory).

A successful exploit allows a low-privileged, read-only user to obtain the Ingestion Bot's JWT and impersonate this highly privileged service account. The Ingestion Bot Role typically has broad permissions across the OpenMetadata instance, enabling an attacker to perform destructive modifications (e.g., altering or deleting metadata descriptions, pipeline configurations), access sensitive service metadata and sample data that would otherwise be restricted by role-based access controls, and potentially disrupt data ingestion pipelines. The vulnerability was demonstrated in the Collate Sandbox, where the reporter successfully mutated a database description using the leaked JWT, confirming real-world exploitability (GitHub Advisory).

A proof-of-concept (PoC) is publicly documented in the GitHub Security Advisory, with detailed reproduction steps. The reporter demonstrated exploitation against the live Collate Sandbox environment. There is no current evidence of in-the-wild exploitation beyond the researcher's PoC, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.012–0.018%, indicating a low but non-zero probability of exploitation in the near term (GitHub Advisory, OpenMetadata Advisory).

1. Obtain a low-privilege account: Register or log in to an OpenMetadata instance with any authenticated account — even a read-only or sandbox account with minimal permissions.
2. Navigate to the Services page: In the OpenMetadata UI, browse to the Services section (e.g., a database service such as sample_athena, acme_nexus_redshift, or sample_postgres).
3. Open browser developer tools: Launch the browser's Developer Console (F12) and navigate to the Network tab.
4. Capture the API response: Observe the network request made to api/v1/services/ingestionPipelines (or /api/v1/ingestionPipelines) triggered by the UI. Inspect the JSON response body and locate the jwtToken field containing the Ingestion Bot's JWT.
5. Extract the JWT: Copy the jwtToken value from the response.
6. Issue privileged API calls: Use the extracted JWT as a Bearer token in HTTP requests to the OpenMetadata API to perform actions under the Ingestion Bot's identity — such as modifying metadata descriptions, altering pipeline configurations, or accessing restricted service data (GitHub Advisory, OpenMetadata Advisory).

• Network: Unusual API calls to /api/v1/ingestionPipelines or /api/v1/services/ingestionPipelines from non-admin user sessions; subsequent API requests using the Ingestion Bot JWT from IP addresses or user agents inconsistent with the bot's normal operation.
• Logs: OpenMetadata access logs showing read-only user accounts querying ingestion pipeline endpoints followed by write/modify operations attributed to the Ingestion Bot identity; API audit logs recording metadata mutations (e.g., description changes) originating from unexpected source IPs.
• Application Behavior: Unexpected changes to metadata descriptions, pipeline configurations, or service definitions in OpenMetadata that do not correspond to scheduled ingestion activity; access to sample data or service metadata by accounts that should not have such permissions (GitHub Advisory).

Upgrade OpenMetadata to version 1.11.8 or later, which contains the fix for this vulnerability (OpenMetadata Release). As an interim workaround prior to patching, restrict network-level access to the /api/v1/ingestionPipelines endpoint so only trusted administrators can reach it, and implement API gateway or firewall rules accordingly. Additionally, rotate all Ingestion Bot JWT tokens immediately in affected environments to invalidate any tokens that may have been exposed, and audit recent API activity under the Ingestion Bot account for unauthorized actions (GitHub Advisory, OpenMetadata Advisory).

The vulnerability was reported by researcher amfor and published to the GitHub Advisory Database on February 11, 2026. A technical write-up was published at Infinitsec covering the JWT leakage mechanics. The issue received coverage from aggregators including The Hacker Wire and Loginsoft's weekly threat landscape summary, indicating moderate community awareness. No major vendor statements beyond the official GitHub advisory have been identified (GitHub Advisory).