https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 02:28:49 +0000 https://cve.radiocsirt.org/vuln/cve-2026-46481 <p><strong>Affected:</strong> open-metadata OpenMetadata</p> <p>OpenMetadata is a unified metadata platform. Prior to version 1.12.4, a non-admin SSO user can trigger a TEST_CONNECTION workflow for a Database Service and receive, in the HTTP 201 response of POST /api/v1/automations/workflows, both the cleartext database password in request.connection.config.password and the ingestion bot JWT in openMetadataServerConnection.securityConfig.jwtToken. The leaked ingestion-bot token can then be reused as Authorization: Bearer &lt;jwt&gt; to access sensitive service APIs with bot-level privileges. This issue has been patched in version 1.12.4.</p> <p><strong>Affected:</strong> open-metadata OpenMetadata</p> <p>OpenMetadata is a unified metadata platform. Prior to version 1.12.4, a non-admin SSO user can trigger a TEST_CONNECTION workflow for a Database Service and receive, in the HTTP 201 response of POST /api/v1/automations/workflows, both the cleartext database password in request.connection.config.password and the ingestion bot JWT in openMetadataServerConnection.securityConfig.jwtToken. The leaked ingestion-bot token can then be reused as Authorization: Bearer &lt;jwt&gt; to access sensitive service APIs with bot-level privileges. This issue has been patched in version 1.12.4.</p> https://cve.radiocsirt.org/vuln/cve-2026-46481