Cyber Resilience

CVE-2026-22244

HighPublic PoCRCE

Published: 08 January 2026

Published
08 January 2026
Modified
15 January 2026
KEV Added
—
Patch
—
CVSS Score v4 8.5 CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0076 50.5th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-22244 is a high-severity Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) vulnerability in Open-Metadata Openmetadata. Its CVSS base score is 8.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 49.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-22244 is a remote code execution vulnerability affecting OpenMetadata, a unified metadata platform. Versions prior to 1.11.4 are vulnerable due to Server-Side Template Injection (SSTI) in FreeMarker email templates, mapped to CWEs-1336 and CWE-94.

An attacker must possess administrative privileges to exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation enables remote code execution, resulting in high impacts to confidentiality, integrity, and availability, as indicated by the CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Mitigation is available in OpenMetadata version 1.11.4, which contains a patch. Details are provided in the GitHub security advisory GHSA-5f29-2333-h9c7 and the patching commit bffe7c45807763f9b682021d4211c478d2a08bb3.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability details

OpenMetadata is a unified metadata platform. Versions prior to 1.11.4 are vulnerable to remote code execution via Server-Side Template Injection (SSTI) in FreeMarker email templates. An attacker must have administrative privileges to exploit the vulnerability. Version 1.11.4 contains a patch.

CWE(s)
CWE-1336CWE-94

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059 Command and Scripting Interpreter Execution
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
attack.mitre.org →
Why these techniques?

SSTI in public-facing OpenMetadata server directly enables remote exploitation for code execution (T1190); resulting RCE facilitates arbitrary command/script execution on the host (T1059).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-26010Same product: Open-Metadata Openmetadata
CVE-2026-28783Shared CWE-1336, CWE-94
CVE-2026-26045Shared CWE-94
CVE-2024-11600Shared CWE-94
CVE-2025-67979Shared CWE-94
CVE-2026-34906Shared CWE-1336
CVE-2024-57177Shared CWE-1336
CVE-2024-54954Shared CWE-1336
CVE-2025-6000Shared CWE-94
CVE-2024-54756Shared CWE-94

Affected Assets

open-metadata
openmetadata
≤ 1.11.4

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly requires application of the vendor patch in OpenMetadata 1.11.4 that eliminates the FreeMarker SSTI flaw.

SI-10 Information Input Validation good match
prevent

Mandates validation and sanitization of all user-supplied template content to block server-side template injection leading to RCE.

AC-6 Least Privilege partial match
prevent

Restricts administrative accounts to the minimum privileges needed, limiting the ability of an admin to reach and abuse the vulnerable email-template function.

References