Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.open-metadata:openmetadata-service | maven | < 1.12.4 | 1.12.4 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the org.openmetadata.service.resources.automations.WorkflowResource class, which handles API requests for workflows. Multiple public methods in this class (create, createOrUpdate, get, list, etc.) were returning Workflow objects that contained sensitive information. This was because they all used a common private helper method, decryptOrNullify, to process the workflow object before sending it in the response. This helper method was incorrectly designed to enrich the object with an openMetadataServerConnection field, which included the ingestion-bot's JWT token and the service's database password in cleartext. The exploit PoC focuses on the create endpoint for a TEST_CONNECTION workflow, but the patch and the associated tests confirm that other endpoints for retrieving workflow data were also affected. The fix was applied directly within the decryptOrNullify method to explicitly set the openMetadataServerConnection field to null, thereby removing the sensitive data from all API responses returned by this resource class.
org.openmetadata.service.resources.automations.WorkflowResource.createopenmetadata-service/src/main/java/org/openmetadata/service/resources/automations/WorkflowResource.java
org.openmetadata.service.resources.automations.WorkflowResource.createOrUpdateopenmetadata-service/src/main/java/org/openmetadata/service/resources/automations/WorkflowResource.java
org.openmetadata.service.resources.automations.WorkflowResource.getopenmetadata-service/src/main/java/org/openmetadata/service/resources/automations/WorkflowResource.java
org.openmetadata.service.resources.automations.WorkflowResource.listopenmetadata-service/src/main/java/org/openmetadata/service/resources/automations/WorkflowResource.java