THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-22244 (HIGH 7.2) — OpenMetadata is a unified metadata platform. Versions 1.5.0 through 1.11.3 are vulnerable to remote code execution via Server-Side Template Injection (SSTI) in FreeMarker email templates. An attacker must have administrative privileges to exploit the vulnerability. Version 1.11.4

[NVD] CVE-2026-22244 (HIGH 7.2) — OpenMetadata is a unified metadata platform. Versions 1.5.0 through 1.11.3 are vulnerable to remote code execution via Server-Side Template Injection (SSTI) in FreeMarker email templates. An attacker must have administrative privileges to exploit the vulnerability. Version 1.11.4

lownvdPublished 2026-01-08

CVE-2026-22244 CVSS: 7.2 HIGH Published: 2026-01-08T16:16:02.647

OpenMetadata is a unified metadata platform. Versions 1.5.0 through 1.11.3 are vulnerable to remote code execution via Server-Side Template Injection (SSTI) in FreeMarker email templates. An attacker must have administrative privileges to exploit the vulnerability. Version 1.11.4 contains a patch.

MITRE ATT&CK techniques

Template InjectionT1221

Indicators of compromise

CVE-2026-22244cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-22244