8.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-22244

CVE-2026-22244: OpenMetadata Server-Side Template Injection (SSTI) in FreeMarker email templates that leads to RCE

OpenMetadata is a unified metadata platform. Versions prior to 1.11.4 are vulnerable to remote code execution via Server-Side Template Injection (SSTI) in FreeMarker email templates. An attacker must have administrative privileges to exploit the vulnerability. Version 1.11.4 contains a patch.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-22244

CVE-2026-22244:

8.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.open-metadata:platform	maven	< 1.11.4	1.11.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis is based on the detailed vulnerability description provided, which clearly identifies the root cause of the Server-Side Template Injection (SSTI) vulnerability. The core of the vulnerability is in the getTemplate method within the DefaultTemplateProvider.java file. This method takes a template name, fetches the corresponding template content from the database (which can be modified by an administrator), and then creates a new FreeMarker Template object. The critical flaw is that it initializes this template with a default, unsandboxed Configuration. This default configuration permits the use of powerful and dangerous FreeMarker built-ins, such as ?new(), which allows for the instantiation of arbitrary Java objects. The provided exploit PoC demonstrates how an attacker can use this to instantiate freemarker.template.utility.Execute and pass shell commands to it, achieving RCE. The provided patch correctly remediates this by creating a secure, sandboxed Configuration that disables these dangerous features before creating the template object. The function org.openmetadata.service.util.DefaultTemplateProvider.getTemplate is therefore the explicitly vulnerable function, as it is responsible for creating the insecure template object that enables the exploit.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.