Advisories for Maven/Org.open-Metadata/Openmetadata-Service package

This is not applicable if an application is configuring the Secrets Store to store credentials. Please make sure to follow the best practices when deploying in production In OpenMetadata 1.12.1, a non-admin SSO user can trigger a TEST_CONNECTION workflow for a Database Service and receive, in the HTTP 201 response of POST /api/v1/automations/workflows, both: The cleartext database password in request.connection.config.password. The ingestion bot JWT in openMetadataServerConnection.securityConfig.jwtToken. The leaked ingestion-bot token …

OpenMetadata <=1.4.1 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the WorkflowDAO interface. The workflowtype and status parameters can be used to build a SQL query.

This issue may lead to Remote Code Execution.

This issue may lead to Remote Code Execution by a registered and authenticated user.

This issue may lead to Remote Code Execution by a registered and authenticated user