{"id":"CVE-2026-100373","summary":"OpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypass","details":"OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses. Users permitted to create or update EventSubscription can set webhook destinations to internal hosts, allowing the server to send requests to private networks and cloud metadata endpoints while returning HTTP status codes that enable blind SSRF probing.","modified":"2026-09-27T08:03:01.926935Z","published":"2026-09-25T19:38:29.984Z","database_specific":{"cwe_ids":["CWE-918"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100373.json","cna_assigner":"VulnCheck"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100373.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100373"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/openmetadata-through-2.0.2-ssrf-via-webhook-url-validation-bypass"},{"type":"REPORT","url":"https://github.com/open-metadata/OpenMetadata/issues/32592"},{"type":"FIX","url":"https://github.com/open-metadata/OpenMetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f"},{"type":"PACKAGE","url":"https://github.com/open-metadata/OpenMetadata"},{"type":"ARTICLE","url":"https://github.com/open-metadata/OpenMetadata/blob/2.0.2-release/openmetadata-service/src/main/java/org/openmetadata/service/util/URLValidator.java#L34-L47"},{"type":"EVIDENCE","url":"https://gist.github.com/naif-alfardan/8a69e0648e11b07abe63f949346179c1"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/open-metadata/openmetadata","events":[{"introduced":"0"},{"fixed":"c49ec6b147d26597fe6053c55196583900954eef"},{"fixed":"8f44482ac89bad9227df5b7f79beca2efe50c05f"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.0.2"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["2.0.1-release","2.0.0-release","1.0.0-alpha-release","0.8.1-release","0.4.0-pre","0.3.1-release","0.3.0-SNAPSHOT.pre2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100373.json","vanir_signatures_modified":"2026-09-27T08:03:01Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f","target":{"file":"openmetadata-service/src/test/java/org/openmetadata/service/util/URLValidatorTest.java","function":"testValidOktaUrlsWithFdPrefix"},"deprecated":false,"digest":{"length":433,"function_hash":"213762854029979177739404779277064091814"},"id":"CVE-2026-100373-05c0bbbe","signature_type":"Function"},{"id":"CVE-2026-100373-07ad23f6","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/EventSubscriptionRepository.java","function":"prepare"},"deprecated":false,"digest":{"function_hash":"245234600219637229797479000088944410786","length":1230}},{"digest":{"line_hashes":["27086729661268477762015271624958525046","204136098907533642617500796065977289655","23649403435463546314767683309059999264","85719057484980074471977063143382693706","606846234722780355334305822287623680","115049733374336379438096632039901120170","153597686863226410231407472912846366710","271899601537154376715140797675229882008"],"threshold":0.9},"id":"CVE-2026-100373-0878c757","signature_type":"Line","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/c49ec6b147d26597fe6053c55196583900954eef","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/resources/teams/UserResource.java"},"deprecated":false},{"target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/util/URLValidator.java","function":"getString"},"deprecated":false,"digest":{"function_hash":"246752066142958455540932252998855884944","length":646},"id":"CVE-2026-100373-109619c5","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f"},{"id":"CVE-2026-100373-12562254","signature_type":"Line","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/c49ec6b147d26597fe6053c55196583900954eef","target":{"file":"openmetadata-integration-tests/src/test/java/org/openmetadata/it/tests/TeamResourceIT.java"},"deprecated":false,"digest":{"line_hashes":["206659064592655304266934833514394735278","250957408144592176886943147550622360328","293815006980222128714211520058554144844"],"threshold":0.9}},{"target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/util/OAuth2TokenManager.java","function":"createTokenClient"},"deprecated":false,"digest":{"length":204,"function_hash":"330685659248723131132688529809720424838"},"id":"CVE-2026-100373-1dc295de","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/notifications/recipients/context/WebhookRecipient.java","function":"prepareWebhookHeaders"},"deprecated":false,"digest":{"function_hash":"263377669603436759335553324185318720852","length":1166},"id":"CVE-2026-100373-23889b98"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f","target":{"file":"openmetadata-service/src/test/java/org/openmetadata/service/util/URLValidatorTest.java","function":"testValidUrlsWithFe80Prefix"},"deprecated":false,"digest":{"function_hash":"326134398181710158534760590331136457800","length":183},"id":"CVE-2026-100373-25b7ca55"},{"signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/governance/workflows/elements/nodes/automatedTask/sink/providers/WebhookSinkProvider.java"},"deprecated":false,"digest":{"line_hashes":["84817079006337622395132862047995018603","57216148311152517390888865160556006005","98511898744149946297469482622016032357","271607454676046304342262070314507658137","127540277617496582432707655360239512289","77712397602365739299614491403698029006","209806221192797972985554291521637881726","338253729618797817429008003247721807244","129017108713252964739935112729984567603","267831351467943716036496887727668244608","323218815316045101237970532100209962013","73713566700586155546529565998266538568","115475414500506309651706648310027949602","327570797362184766145484502495642590742"],"threshold":0.9},"id":"CVE-2026-100373-3ac2aac7","signature_type":"Line"},{"id":"CVE-2026-100373-3f13654d","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/util/URLValidator.java","function":"validateURL"},"deprecated":false,"digest":{"function_hash":"126665774669446218258172441761202481251","length":320}},{"target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/TeamRepository.java"},"deprecated":false,"digest":{"line_hashes":["68941810052407531686011052637608407275","92687507438859249674130094723051925031","205806926680506058288560623088639675402","134710766371918712317344233300968667888","85670131555344302689300629107992806275","161537362992167707616192923736952588293","1077192490507513403392202581442563723","170799544502131160281933643677983838414","120807284221669369700396296670691283075","203716995887103619151616123828588392920","316675007401912400230009767002833007154","22696852090277985242269267400841701453","207026875082831538832290619795827481504","178905198892951466620551939414691840212","72783209754745574685450403450257747603"],"threshold":0.9},"id":"CVE-2026-100373-40c9b614","signature_type":"Line","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/c49ec6b147d26597fe6053c55196583900954eef"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/c49ec6b147d26597fe6053c55196583900954eef","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/CollectionDAO.java"},"deprecated":false,"digest":{"line_hashes":["142092233430647600448930191815652758707","250813024700673259019176390683036101878","333389482620139650392682567241972057632","50569958549847385734595276429679805589","331530254288900472156471950651841051559","286726121658293822510846729992479772978","196429255264954536264652953260441972438","9175824042681505449861936876334701917","106252650781924799351818929688388875831","127793590914743545864648093946443529467","176652370175382600737244094797202005666","29176116012043914558982535424495826329","33802454415290799085179086156769650828","125113416510142921124270256388966270826","203814167554679321034604480378353329614","335672029088100176950877008079754407864","20894679640577918860169078847355634067","24996893368976972420773430926688099872","146013484998426493466963216836938391050","286726121658293822510846729992479772978","196429255264954536264652953260441972438","9175824042681505449861936876334701917","106252650781924799351818929688388875831","127793590914743545864648093946443529467","176652370175382600737244094797202005666","320703064823971548150628730675210406132","132013535887195529921622192689285571810","276596568465768412147134396984825097452","327085921513349768370891486759305688398","184235737127595847146402571616501313058","30542646196646900441920677664065769121","158911212671077854343566630163654438262","286726121658293822510846729992479772978","196429255264954536264652953260441972438","9175824042681505449861936876334701917","106252650781924799351818929688388875831","127793590914743545864648093946443529467","176652370175382600737244094797202005666","320703064823971548150628730675210406132","132013535887195529921622192689285571810","271636701538438613270106571901847909130","91673640365212139619903688448530440094"],"threshold":0.9},"id":"CVE-2026-100373-42b418ed"},{"source":"https://github.com/open-metadata/openmetadata/commit/c49ec6b147d26597fe6053c55196583900954eef","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/TeamRepository.java","function":"clearFields"},"deprecated":false,"digest":{"function_hash":"227169219987099743284150768024984547684","length":880},"id":"CVE-2026-100373-43ce66e4","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/open-metadata/openmetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f","target":{"file":"openmetadata-integration-tests/src/test/java/org/openmetadata/it/tests/EventSubscriptionResourceIT.java"},"deprecated":false,"digest":{"line_hashes":["298706272039382424556234821524747224630","191301281738289231831709372761189177786","208633128517194709533956901339554678570","27706983341860757372563641090371173784","165787700986095352284652065838570777158","335099419858754407170360987115509462172","298120280211420813032416476325120092721","330745742220244461825563546796403788373","87215708782002800818946043478671754839","253831230710301470509927646611181843743","256733461305024085405361632761811692054","190195546573746983916823459642212733750","201432836924036322006152391938519885550"],"threshold":0.9},"id":"CVE-2026-100373-43ec33dd","signature_type":"Line","signature_version":"v1"},{"digest":{"line_hashes":["60456987439296282284750898995435844312","324310134981425867304848592097129310215","63490723485083341895432127856537034425"],"threshold":0.9},"id":"CVE-2026-100373-50b6e199","signature_type":"Line","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/c49ec6b147d26597fe6053c55196583900954eef","target":{"file":"openmetadata-integration-tests/src/test/java/org/openmetadata/it/tests/UserResourceIT.java"},"deprecated":false},{"source":"https://github.com/open-metadata/openmetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/util/SubscriptionUtil.java","function":"getClient"},"deprecated":false,"digest":{"function_hash":"327244692093519430958232673276026592481","length":610},"id":"CVE-2026-100373-52f69baf","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["116010803277505559534938932427328114858","329140832283311136972107175528975790142","34960697648234611054171329807832082688","143458727424300375053204184752371290204"],"threshold":0.9},"id":"CVE-2026-100373-59242d9a","signature_type":"Line","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/c49ec6b147d26597fe6053c55196583900954eef","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/resources/teams/TeamResource.java"}},{"id":"CVE-2026-100373-65183f71","signature_type":"Line","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/util/URLValidator.java"},"deprecated":false,"digest":{"line_hashes":["65269617104347762709539701896715558332","325568968937794529319118948676175983870","116279944345318808688487306904094610310","317029896641217308584137304835003637590","139021512345090412911096660886796044430","115319944485405786238400177505597620916","27915870714080411357981810349367969191","161108082944742600529772101398411745515","269294910162037163841223879657541835170","63906264315305523519609725545608644111","208010561447694068132474062622516575803","219404392458483119373135651108918940606","324579524756902014335859789044798948672","302694446543403665385114688682728631557","27665308636620894495976685610268107589","108946649850356900765469318071775355179","106910311288355728069301756966091641646","317604191197234546000512705618321092218","250319128974201767891826118643051100471","25363784520316091443166376675919743666","4702245881089611198593113082069582010","135581673031216397769828996031597868417","325466815412179646109087999173742222477","166014467726724000313698692814274147013","158834621071162247732381364821865061858","301501495241760003935938931332656701043","76633785209129905993444615613563515379","256161644574071494542766436218365846583","12541073387284190819596556981194286690","166464779519673171614214670911869223745","300850773675959233120175210091731737838","36635292031878999596961655486731146487","168252295944034788655889777880159144453","291329971588197041351621391476360332698","118855318370317143536256426468206833438","58277426930442763808379836813450124856","317014936185711330420294984972447745007","327074227785766813597310371929434047224","180473839538816439884733847553342446132","38050087332141229418535801677418023576","134708043969881812386120812776165415963","251907282045046001882752571371942373763","260866783435097582119363405643541616786","240248453229237359281245342279019525824","268388631299295408248357714359184077949","88479557855463612832356923583086955800"],"threshold":0.9}},{"deprecated":false,"digest":{"line_hashes":["305349871248829253287992832288745232130","187603773377379323043181411808505234097","101172498521791462742357593433412898394","207723085997529946819987333340003129295","325973589158557421798991869517492643380","234954314444027298215048129852173121872","141065398111539429507493980962483059607","303556854997304674352770316339232451828","123389096012693851866752208392381334239","247864576893790199970122576272839109216","197248935999729691397569725017799770131","44424821603154837347863406889390877314","225028273753222631544851061983662502212","145885383986611151636859379269263273254","135555894338118974541477960165248621546","310054844568829377980736215716155891866","282426436572964263953235292889538686298","166259461287430853795976092329040817838","11820963409212512566337334531677643213","219559267500695709611764778973396826079","94159364704719246804616757140321039575","293299504085672080723652594059576158441","295759894348849960033551842598174735239","146495598906525010156884849194129740182","59713942044336755488868738180819862184","16733882180190904195531558150357793189","335312999361279413638205931673790033234","157491549431174606113296264682367157757","197970234858722324668040281997333700079","275823046215748305117997480095115815735","116973558496478733130277369859748569658","211613568310306060681226586129858315395","57741548887723388473500601840519804164","65854764836998978844586919627615355296","47851255923696913463737274875700882408","304513246462482731608525577222628739647","173708584266278219515962646430617559397","251078464055500460065853528433782146418","125685240937759853946027129376006419586","261239260493211193169654560915459764587","331771178333401814994051538733687682883","134063397847665907156548422063151153792","46356846036251072848911479798224939170","208049583919913588534396032863698880749","191544002547181867274998631561387928344","322702288992702353083021689534585785160","53586735722177830846343585047649870587","97315886779442222273362228608285770100","303655780705154111757521542687840102977","264458877336781722033122914112376268395","214968098434959256077726152544976308037","178008196159128365643080896388499010772","54738969873912842247479997882893519014","231881313129346674645074361083225820798"],"threshold":0.9},"id":"CVE-2026-100373-6a67baa4","signature_type":"Line","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/notifications/recipients/context/WebhookRecipient.java"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f","target":{"file":"openmetadata-service/src/test/java/org/openmetadata/service/util/URLValidatorTest.java","function":"testValidUrlsWithFcPrefix"},"deprecated":false,"digest":{"length":177,"function_hash":"61645079824222412010225877539264558689"},"id":"CVE-2026-100373-911bbbfe"},{"deprecated":false,"digest":{"length":389,"function_hash":"84141832292751845180181685911337876104"},"id":"CVE-2026-100373-92e6c2ba","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/notifications/recipients/context/WebhookRecipient.java","function":"getConfiguredRequest"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/util/SubscriptionUtil.java"},"deprecated":false,"digest":{"line_hashes":["27498426787394654705195667230085504933","288450077357541818025478050823530529907","51714023375555246045912762471677370099","72119996489555970144583074971959034076","137673542148625678910754599037062772384","281615787747155368591375771407848518065","266393163027471204974470350579571070215","239024666697753674153236768217992623458","284706638841299981507710506821633647307","69266068615148447921962450048672103909","37431081178347564458304642625533381358","173924874751461867577535615472787158781","46356846036251072848911479798224939170","208049583919913588534396032863698880749","191544002547181867274998631561387928344","322702288992702353083021689534585785160","53586735722177830846343585047649870587","53798771086454027734981656864109249013","52001380662812304047196541341732533899","110855189424589589344629350726803779516","306360491072455963539120562996804878717","100815121741699249938973973452591601185","117621961059681868747669622648503607827","131065001302160702158338614864660567212","261044477279909484065370885307742134649","100327153640827719036331976136590517830","158349761369230816254501900830579959370","151072971597588605793084798043485793779"],"threshold":0.9},"id":"CVE-2026-100373-95270b32"},{"target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/EventSubscriptionRepository.java"},"deprecated":false,"digest":{"line_hashes":["37170157611109733492975385055250927945","66268719618098379100660581316538426195","6863899479744562572381324209318841854","82749913860571042618639459781583929846","135654873876204830080191918210914108881","177165803504949913069452336373717292861","78646435622331846111070993496701778028","291304531375878924432321113085787433380","146423029920907509854455788213601021862","294471108277036000079679522691679772531","788147559843259588395174139693495925","169763493271363151630244337320398680759","185552020931870123240939032626656086064","119705769041798592581149414232582247750","31247209760838116216412741124507543247","148426459285397141740815108611953511970","130309312147474884935931544016241854333","198299201860082453028770477382026676950","310256650954083631524271221970226305793","119738655486924919136164383806709817950","323047321986354632241761503010899328891","107313950439022718172139499259929420666","154520456797207724653380842711685660560","238141156429813676373992363970504839286","172065273267011711571910772645649604216","316359291309111087579511205437545102741"],"threshold":0.9},"id":"CVE-2026-100373-9891d627","signature_type":"Line","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f"},{"id":"CVE-2026-100373-b399ef3f","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/c49ec6b147d26597fe6053c55196583900954eef","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/resources/teams/UserResource.java","function":"list"},"deprecated":false,"digest":{"function_hash":"44786663155716850171828875738998856649","length":2492}},{"deprecated":false,"digest":{"function_hash":"68026216543365984412607571681927388142","length":1134},"id":"CVE-2026-100373-c1531ca5","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/util/SubscriptionUtil.java","function":"prepareWebhookHeaders"}},{"deprecated":false,"digest":{"function_hash":"110090743407361807385509345940629248551","length":140},"id":"CVE-2026-100373-cb7a2e6d","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/governance/workflows/elements/nodes/automatedTask/sink/providers/WebhookSinkProvider.java","function":"WebhookSinkProvider"}},{"source":"https://github.com/open-metadata/openmetadata/commit/c49ec6b147d26597fe6053c55196583900954eef","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/TeamRepository.java","function":"setFields"},"deprecated":false,"digest":{"function_hash":"35594385105974307550021359859527550499","length":1098},"id":"CVE-2026-100373-cc56784f","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/open-metadata/openmetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/util/OAuth2TokenManager.java"},"deprecated":false,"digest":{"line_hashes":["95483403254855622225727803357962945924","116979595828706847777149703924046783499","272125836331255306195207118059969465667","65435488991521280683412022172870806052","322296974977157149582818145384281188659","194153606842880763741213813423316718367","56525060396065143753763343666041729866","103174944340774844694565834857985403280","199529121310824118598590215184761544181","111385133018748250807937075502837660483","238557466707409534110106255206612160408"],"threshold":0.9},"id":"CVE-2026-100373-d939f907","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"192087705570539774200794762195841673841","length":367},"id":"CVE-2026-100373-e2029391","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f","target":{"file":"openmetadata-service/src/test/java/org/openmetadata/service/util/URLValidatorTest.java","function":"testValidPublicUrls"},"deprecated":false},{"target":{"file":"openmetadata-service/src/test/java/org/openmetadata/service/util/URLValidatorTest.java"},"deprecated":false,"digest":{"line_hashes":["245641229681773074801220431663106262183","152582654937124335881923142730663398648","83156485334496559097800523594651354662","193493829584006667707886555047351866913","115220533114339627276168914828388778413","295796769964614082187218660713550744939","139385947756232184226587890582105000559","124998563296358052937485619763212133587","184059713610283409031568569300996847853","312368130618998436145479338388650217515","288285291380270476341225789398056266224","318726288420313281818713103448693466073","274989379086265097092400034492641187263","8595579254928788335197543498920660563","219903897520170215704476132537086302551","253953691825924397766478339532022185219","288448365699364149156419376234041677046","213386534381696180267362028963665961225","319464239458663765522352268085108040770","336045702489721483250317104178799504716","74006592445570480103062553099728368724","309178709451481133772155736465951774990","108543856603186922264430880870704575589","317633560991338245084877854376620372158","98684314186562738502255436922860176899","80431024209888126655678618495246574764","333821741712937984870855134039958122502","270318895105366514578396642737109044930","323922386298269486379725113172866026075","117993283799720428997167804234316102429","173634845716054515791076003120164954950","61085923533089864323520378685755405260","232338723259646315361941103773308548030","159934255454064530948873098600913421815","14580646959375362007583021144474727236","115915022894061974075203342215063874755"],"threshold":0.9},"id":"CVE-2026-100373-f393765b","signature_type":"Line","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/8f44482ac89bad9227df5b7f79beca2efe50c05f"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"}]}