---
id: CVE-2026-100373
title: >-
  OpenMetadata through 2.0.2 contains a server-side request forgery
  vulnerability in the URLValidator.validateURL function that fails to properly
  resolve DNS hostnames and validate internal addresses
summary: >-
  OpenMetadata through 2.0.2 contains a server-side request forgery
  vulnerability in the URLValidator.validateURL function that fails to properly
  resolve DNS hostnames and validate internal addresses. Users permitted to
  create or update Ev…
severity: medium
cvss: 4.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N'
cwe:
  - CWE-918
vendor: open-metadata
product: OpenMetadata
affected:
  - OpenMetadata <= 2.0.2
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T21:17:21.393'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-100373'
references:
  - url: 'https://gist.github.com/naif-alfardan/8a69e0648e11b07abe63f949346179c1'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/open-metadata/OpenMetadata'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/open-metadata/OpenMetadata/blob/2.0.2-release/openmetadata-service/src/main/java/org/openmetadata/service/util/URLValidator.java#L34-L47
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/open-metadata/OpenMetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f
    label: disclosure@vulncheck.com
  - url: 'https://github.com/open-metadata/OpenMetadata/issues/32592'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/openmetadata-through-2.0.2-ssrf-via-webhook-url-validation-bypass
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-25T20:37:13.790472Z'
ingestedAt: '2026-09-25T20:17:49.418Z'
---

## Overview

OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses. Users permitted to create or update EventSubscription can set webhook destinations to internal hosts, allowing the server to send requests to private networks and cloud metadata endpoints while returning HTTP status codes that enable blind SSRF probing.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.