{"id":"CVE-2026-22244","summary":"OpenMetadata Server-Side Template Injection (SSTI) in FreeMarker email templates that leads to RCE","details":"OpenMetadata is a unified metadata platform. Versions 1.5.0 through 1.11.3 are vulnerable to remote code execution via Server-Side Template Injection (SSTI) in FreeMarker email templates. An attacker must have administrative privileges to exploit the vulnerability. Version 1.11.4 contains a patch.","aliases":["GHSA-5f29-2333-h9c7"],"modified":"2026-09-02T08:09:26.869467Z","published":"2026-01-08T15:12:51.103Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-1336"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22244.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22244.json"},{"type":"ADVISORY","url":"https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-5f29-2333-h9c7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22244"},{"type":"FIX","url":"https://github.com/open-metadata/OpenMetadata/commit/bffe7c45807763f9b682021d4211c478d2a08bb3"},{"type":"FIX","url":"https://github.com/open-metadata/OpenMetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/open-metadata/openmetadata","events":[{"introduced":"0"},{"fixed":"adbe4431db9c861987bca681a156cb5062df0c84"},{"fixed":"bffe7c45807763f9b682021d4211c478d2a08bb3"},{"fixed":"d17d13cee87db139e5d8f778547174f8ee341108"}],"database_specific":{"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:open-metadata:openmetadata:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"1.11.4"}]}}],"versions":["1.11.0-release","1.11.1-release","1.11.3-release","1.11.2-release","1.0.0-alpha-release","0.8.1-release","0.4.0-pre","0.3.1-release","0.3.0-SNAPSHOT.pre2"],"database_specific":{"vanir_signatures":[{"source":"https://github.com/open-metadata/openmetadata/commit/adbe4431db9c861987bca681a156cb5062df0c84","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/migration/postgres/v1110/Migration.java"},"deprecated":false,"digest":{"line_hashes":["51834898959253789355240757164876697339","270273916587880431979287235350556209338","16054123665087782559531887014602331552"],"threshold":0.9},"id":"CVE-2026-22244-0adbf009","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/adbe4431db9c861987bca681a156cb5062df0c84","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/migration/utils/v1110/MigrationUtil.java","function":"insertV000RecordIfMissing"},"deprecated":false,"digest":{"function_hash":"8388154987470262310528445150254650542","length":826},"id":"CVE-2026-22244-0bfae92e","signature_type":"Function"},{"source":"https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/DocumentRepository.java","function":"entitySpecificUpdate"},"deprecated":false,"digest":{"function_hash":"256775582256598110854758772218372841247","length":102},"id":"CVE-2026-22244-13c3f74c","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["51834898959253789355240757164876697339","270273916587880431979287235350556209338","16054123665087782559531887014602331552"],"threshold":0.9},"id":"CVE-2026-22244-16a92a53","signature_type":"Line","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/adbe4431db9c861987bca681a156cb5062df0c84","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/migration/mysql/v1110/Migration.java"}},{"deprecated":false,"digest":{"function_hash":"123238065180946451469122173811773356066","length":203},"id":"CVE-2026-22244-16b8504d","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/DocumentRepository.java","function":"DocumentRepository"}},{"id":"CVE-2026-22244-183866c1","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108","target":{"function":"create","file":"openmetadata-service/src/main/java/org/openmetadata/service/resources/docstore/DocStoreResource.java"},"deprecated":false,"digest":{"function_hash":"242911513198465048023009136950060526305","length":203}},{"target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/migration/api/MigrationWorkflow.java","function":"loadMigrations"},"deprecated":false,"digest":{"function_hash":"4309299065380164269141020178352091165","length":203},"id":"CVE-2026-22244-2754a96b","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/adbe4431db9c861987bca681a156cb5062df0c84"},{"source":"https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/DocumentRepository.java"},"deprecated":false,"digest":{"line_hashes":["274403152672102532820749256470603627113","125804750498863329579726628595555022254","327680533503687973912760099289403126613","161183079062693704711373029668924173171","299023090698485472738986961269560662453","206600197392932027480406347676760366889","178169158366002263596559723945817845778","176181297913986154742139509663263700309","253509284608853935647689192301123392177","163842115911990394758259730067146238859","240069760858377770995727579494592118275","121397403255219254235660765182390897484","314649066354364327391341581173025091204","257304289810874693253314518335514523198","182087859235814904497977234005718357927","193309489743476241620327138575388081289","320317715053747496413047574185810923425","25079416429074776176749338234019769382","285007537731821353614621310371800349176","297090764725602147806602518550208119117","38379138630809402290604679648029282893","133014582456143084319275753380150835200","328176796057398914426655392443808693401","262301811224793089502595475832831041948"],"threshold":0.9},"id":"CVE-2026-22244-2af7c435","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"116558112186239186515427689559496331596","length":633},"id":"CVE-2026-22244-2f6441dd","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108","target":{"function":"sendEmailVerification","file":"openmetadata-service/src/main/java/org/openmetadata/service/util/EmailUtil.java"}},{"digest":{"function_hash":"24100414270304800662238845985442255859","length":67},"id":"CVE-2026-22244-2fcb26ec","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/adbe4431db9c861987bca681a156cb5062df0c84","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/migration/postgres/v1110/Migration.java","function":"runDataMigration"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/adbe4431db9c861987bca681a156cb5062df0c84","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/migration/api/MigrationProcessImpl.java","function":"performSqlExecutionAndUpdate"},"deprecated":false,"digest":{"function_hash":"78837950822964951051698073906247053724","length":855},"id":"CVE-2026-22244-3d4ce33d"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/adbe4431db9c861987bca681a156cb5062df0c84","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/migration/api/MigrationWorkflow.java"},"deprecated":false,"digest":{"line_hashes":["207353529307531116374155435662880313209","8347472063486688851304595505580775936","159558494117612632381898256593444304252","140803849387440476196472558068414246068","54809524354804301556346442897086171574","114361491244056298469316227474401899496","72960051209501277609131411650708134484","254918490099152812517957068554686834333","339629857818599115936950869465698742007","141569642021618104411584849649249438752","169359039232940737125554568768356925475","213087554598934754004788646431984768553","93262996845657224280897757484717895343","327020239812410591517676109234502900828","164804446338975010974002259271708944295","147272635611308764091589484640694008382","29454867516751228872241007287945405754"],"threshold":0.9},"id":"CVE-2026-22244-3f8e4ada"},{"deprecated":false,"digest":{"line_hashes":["66206583040044076972708118242157555820","136276039634073277601854266903756671949","184959558505018931387251751202034164303","146606857118698974804471992174221966964"],"threshold":0.9},"id":"CVE-2026-22244-417d7c5b","signature_type":"Line","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/adbe4431db9c861987bca681a156cb5062df0c84","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/migration/api/MigrationProcessImpl.java"}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["20157155375128964130026463121927470812","158810969304065356524193819584090783972","16628874305183629423339879483385371028"]},"id":"CVE-2026-22244-457838c3","signature_type":"Line","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/exception/CustomExceptionMessage.java"}},{"deprecated":false,"digest":{"line_hashes":["184781954191953452234709338824485818938","318738652501132804647908312649599614582","213489283073041135745960203851935829914"],"threshold":0.9},"id":"CVE-2026-22244-4e6451d5","signature_type":"Line","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108","target":{"file":"openmetadata-spec/src/main/java/org/openmetadata/sdk/exception/WebServiceException.java"}},{"digest":{"threshold":0.9,"line_hashes":["186749276589415073694622333538847671233","72182092603732326249792671194477524063","129744141310530841934288459109771427580","159590328152054559829582198212868456585","189534995892347510360689399681786760432","225609928886211143411781715568215582162","133971864352803140269285819736681661234","42478285113421288543388581660603644556","44208947112704584349062129877211672326","323736921377732912559847417515788458092","974227313492683926586773158838464503","102420185576416875717864593301291666890","107758515652642563229464590303452132707","107831555655604408567815386309812987060","293436087713326945367984676876036559741","63870959685841192745441280957294829646","175950693461854230591873192459510893878","24648063255535538017620978920269859087","293436087713326945367984676876036559741","330579201060881161299347847113687991411","255750026286594093549164766290593624226","26346625926572478845346747385285795950","33063098248326686574384308456820098382","110838915355366019150585053244256023014","293197796239042156199169666975366276288","224505197725087543229966359913666711026","175389616295686278817132825976197423262","15957786157295543487639689092750649824","302576463789042764872474587378808369348","235281362467979008235179187131410201143"]},"id":"CVE-2026-22244-55914509","signature_type":"Line","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/resources/docstore/DocStoreResource.java"},"deprecated":false},{"target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/util/EmailUtil.java","function":"EmailUtil"},"deprecated":false,"digest":{"function_hash":"257729383463098148854990077890008133734","length":223},"id":"CVE-2026-22244-5abde696","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108"},{"id":"CVE-2026-22244-5be7749e","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108","target":{"function":"sendInviteMailToUser","file":"openmetadata-service/src/main/java/org/openmetadata/service/security/auth/BasicAuthenticator.java"},"deprecated":false,"digest":{"function_hash":"51454448378862580560670373538269667838","length":980}},{"deprecated":false,"digest":{"function_hash":"314013167972458661612259257987131502801","length":1790},"id":"CVE-2026-22244-5eca3d58","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/adbe4431db9c861987bca681a156cb5062df0c84","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/migration/utils/v1110/MigrationUtil.java","function":"migrateFlywayHistoryRecords"}},{"deprecated":false,"digest":{"function_hash":"151398521940820146527991243814129709745","length":802},"id":"CVE-2026-22244-5f9ca6e7","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/util/EmailUtil.java","function":"sendDataInsightEmailNotificationToUser"}},{"id":"CVE-2026-22244-61e46f71","signature_type":"Line","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/util/EmailUtil.java"},"deprecated":false,"digest":{"line_hashes":["263034774649467486083348788116743059653","26694146831982981463233162588079326126","164114708910570692833526202186429610656","135179906226622226602580437950906921119","47620606743188983164542039640458844366","7490531088299127424188588469455333594","171659225301704581108707667388785406543","183336846716535185873902157589694057905","29720707678567821239634236755975246472","337318102263474637034845737032979538427","6333675949441205495968777425825878650","242935012226009128781851256794063823763","49077968936918552143204448117110785490","27911255162680712524234893856095824798","7978250544121014416937307873747277732","278438418702398007376498032469616448184","291967745788647443477603919622401582698","32216555657319396378252383475938239203","206434362133358269210655664074728891506","190137704034068206438947978511418749855","170071981424391471394202634862522132724","325450094248382101968003936622818685994","48780927097624716295579590012487334448","236560292514394566619781414035476758078","253323734763999334805393697358573520067","308126660361909269658612980588915428217","71139670391408073593606811427839788757","179923696751220145370520606676101448640","150712469435353400758808001743331770336","313295462114999611790562329486036623560","1135679505602380279558043271476631127","319195493461826326407190245879140776728","337844419305460860430571129094525587407","26907537561891828421602553394737889978","268250921718114215299779657544767171361","151529634944774549021587653259332877073","337149389804445779834409614254324477137","331505923517612488536828011341788936906","167840017667244928777329450391693248272","169394068199654799413258174692975058662","234069503583784453445312280492740666326","71517987585109355329978515558645179287","2151628412349247330739671866215131277","36789889030533079108984960938897190181","231179500903528625589494788804093060653","162116027341237534677292380799896684411","105867800762833111435977615475044463668","208492006063250445692204919994080849831","335440769261153575635681420058624619780","142799093993942872918408031978207409112","276129659123186851847479559806039623048","39904562136174914413536115057228766027","78259969876328158455211896573530743776","312536786177441095986150702982562080565","219570133755676389380646484731437104963","89197958030377397984759954043962059659","249349251504257824496049540768191448411","270930406030361619765213055821358960350","313532083803927618456372637662047118781","6438988035799947866565399168209978979","247700329127639037642889018213018273445","115860689479914307046237853389184639117","167574350993218047310534056415848978788","312006287520221900116538629119057861465","129484502456493433060742815471499444138","170602358885518100673606113411787108251","184913998180262569520652070163830498727","73349224276522383264257288753402379008","317692099105293055848803634927470522957","68704736587117805690801667090105144900","225674515583245092335031456877636942097","232609619842707200964548243535653987119","14287085460756679486312006095464145112","153964708810619891612680889884529374828","321405178135311407981943091846250880605","212526005185253654443259765899328895326","274513287868873073735924969803798548877","229892153255339717230388140392997509000","88506729149077360143809871046003221221","105456509879979942329812515921916803688","50921442414464486983916447314738347647","302725685127938217150177306866833933707","8538584699806074123148504060041464085","303010436180909834016442119203941809863","264896992100909652674752822387998765754","315455887208807988684224822979344492821","44589070317451857837154771250476502471","25252666002557636178480799891215351239","133079927061491802508429884539708745600","268629462467409739245746671253236674094","100498991748652724983268465047471697769","280468523521945671465835305186973806537","264869074921128263215113237563890829829","50921442414464486983916447314738347647","302725685127938217150177306866833933707","8538584699806074123148504060041464085","74727404516363114792042438231321614593","128467656667400870018926646784688880022","138168418101904839460226289422389402254","334569549745358757082966470574567416643","148445946031476683583693435937734092874","81292583525695440468434118776689676947","149128613034391798978523692075528904995","305615134876781273662622025870048504883","12839159783786232693975341270126724263","190287341836011323215375220368998403426","119149608336972283082195088149719987075","258897092107040878586446388888024882840","91232933336119822357485371073650246423","951019587296601368315993795719944568","301684538420459831081978282663937269048","317984145147466559937202088833779685311","152219627144058995827203400843940919366","100926629284107493182282246283032043038","133018611461407433225379726749950288695","35941140582361404229869028261059792036","1986446483851705423342784016042292569","157275149550922996344917701739761175422","249680738612387215554959060485098055235"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/adbe4431db9c861987bca681a156cb5062df0c84","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/migration/mysql/v1110/Migration.java","function":"runDataMigration"},"deprecated":false,"digest":{"function_hash":"24100414270304800662238845985442255859","length":67},"id":"CVE-2026-22244-72cc245e"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108","target":{"file":"openmetadata-service/src/test/java/org/openmetadata/service/resources/docstore/DocStoreResourceTest.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["240927292497139243550539556926875257427","236083535722517413404361104471625191579","285246389518818337155330987707111680725","19236571376059611114677786226710729004","257852425461716388490577431244494757965","10175428098173681804752365517326537478","182623759393790951107300073776969236405","264281481924956294767354196120516536332","322173311019363125030408755576663574329","60891068092622499809161608980193226357","92943081314547839519994155914845094603","42412005904802213185269323312139730164","108371842925045757570382949070884771002","157228990274573023969676644937199827930","148630918822239083387583413125175394685","317244424160462480583185919142127948246","75777719177087444282024479111406258497","252657252518148251842585201441547240828","69601083085642564224613698895565592387","254684364980701005087609007984122593681","150337710644527522701880851252226263600","114400568567317511824761610825848784866","335959313404904035930139521398879781902","121973011742480545373360940179813641295","118016694559041298827350257272304277688","160210155579523211082298482772909304010"]},"id":"CVE-2026-22244-7defb7dd"},{"id":"CVE-2026-22244-8493af3b","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/util/EmailUtil.java","function":"sendPasswordResetLink"},"deprecated":false,"digest":{"function_hash":"155327307286469658475758209751431147338","length":642}},{"digest":{"function_hash":"218534713373101076644839141874390985474","length":866},"id":"CVE-2026-22244-8539ed01","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/util/EmailUtil.java","function":"sendInviteMailToAdmin"},"deprecated":false},{"target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/util/EmailUtil.java","function":"sendMailToMultiple"},"deprecated":false,"digest":{"function_hash":"174250918126137582912273954197403590407","length":621},"id":"CVE-2026-22244-996a9142","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108"},{"id":"CVE-2026-22244-9d8cf272","signature_type":"Line","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/adbe4431db9c861987bca681a156cb5062df0c84","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/migration/utils/v1114/MigrationUtil.java"},"deprecated":false,"digest":{"line_hashes":["148386087734865396118622697052228601470","247753924226171952643177967719877476169","84366447983357170152446443023054460279","20471808833037620582276213183994287270","127654607866139121475909995453103169083","73853675552554058735158054711240345710","68757503621053631143699742475603455425","74308725997918843773242453844637420778","311651507842724901405285484751715556738","319390332561128587812777651330712112425"],"threshold":0.9}},{"digest":{"function_hash":"104386464269409187965275772607396860827","length":890},"id":"CVE-2026-22244-a428966e","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108","target":{"function":"sendTaskAssignmentNotificationToUser","file":"openmetadata-service/src/main/java/org/openmetadata/service/util/EmailUtil.java"},"deprecated":false},{"deprecated":false,"digest":{"length":626,"function_hash":"240254387474116891503376894254177650905"},"id":"CVE-2026-22244-a64fb6d8","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/util/EmailUtil.java","function":"sendAccountStatus"}},{"target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/util/EmailUtil.java","function":"sendTestEmail"},"deprecated":false,"digest":{"function_hash":"263050091243367412035407688944336014740","length":532},"id":"CVE-2026-22244-aaa9459c","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108"},{"deprecated":false,"digest":{"function_hash":"268178942050171612104363801072151137427","length":887},"id":"CVE-2026-22244-ae46ee8e","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/util/EmailUtil.java","function":"sendChangeEventMail"}},{"source":"https://github.com/open-metadata/openmetadata/commit/adbe4431db9c861987bca681a156cb5062df0c84","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/migration/utils/v1110/MigrationUtil.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["68716287472831296899750015177699462292","268341032679781111251555183748625483545","219926343986811918319122201641128781124","246249721355207125858555596365064380046","13860908945162995646899491943270544634","339145792198720485603658993028724950239","261313096008110567320528498720542900600","327440000111412121252142477080586951532","285166563845716364110760873285970917150","256881461787249913608667622390785166308","328670520881604060141115119107846243724","188782032522861787778474969720024050013","141057140995643092308493051404868380009","95998712295120759027143875604856203707","42588412192914000175325225237829246481","297168827576546284572423898614606805732","202643702559483305718463532958738277311","122300469108299112847469157192060490078","322430747429928988968920077819267674731","258887493420613319562000414108862630874","310054494121263785360709305883865110249","313200555570402078514832923746765967701","71201372745114131925943048661877814418","82990646233078223755891749426961499728","167162617226200594620084625772385929105","219539866824754635492757792740725652346","45825425849304619331697054934508138354","107538167045146554568083078193644424688","39837992327610440400280976625141047195","78521297348304461992829096172695346291","142532480254153117743438400504156900540","106219990706570736915725466397568615850","166382334914725419496446183774228027983","166278358800975348676778756164541175936","65288599983567825992316911066307873107","287341221951005777776244039251988136099","46699937900460366108966137725330478006","248785616558447593728431156257321161487","19900085459757486688408294745489671504","146858738701739336872262570829171609737","111256160525847768419551218683828807912","332190830292397749122666272660086785931","185773361026420993376374368739089459584","284761129750209118337809603962895584594","197772140852062371296219292849534432351","101651537243975360854997034813101453744","25710384488708518540098364654328221125","38956896895390641105643509603515867787","137797281769059287621964436677058416302","50664716750112846062436396424060359917","135400638045937149055123582457978233859","239528223042771930430907811164239175479","317624163556517505185628813144739706894","65459303014943262653305594739263392410","31585064015196463234898656816757083996","57681192182648121225023134664864605292","318865885125820445215541310149555858376","177829977784505587789890588225866170221","152868930654041742249034385487566447584","118228527867578039643451141748309562419","303774551290534305734549651817131018515","165973629264958259176556682627881644851","316487385851671076857045725535982431343","118957982589049358367339265450262171216"]},"id":"CVE-2026-22244-b21f7a9c","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["129563673631605485691696809390090125404","76258668123272534527094403198501953462","172603327682428392174674568029599873571"],"threshold":0.9},"id":"CVE-2026-22244-b8b2f274","signature_type":"Line","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/adbe4431db9c861987bca681a156cb5062df0c84","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/util/OpenMetadataOperations.java"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/adbe4431db9c861987bca681a156cb5062df0c84","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/migration/utils/v1110/MigrationUtil.java","function":"migrateFlywayHistory"},"deprecated":false,"digest":{"function_hash":"20303503210009068736088909140385487685","length":787},"id":"CVE-2026-22244-bc26e203"},{"deprecated":false,"digest":{"function_hash":"242911513198465048023009136950060526305","length":203},"id":"CVE-2026-22244-bfb77cdf","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/resources/docstore/DocStoreResource.java","function":"createOrUpdate"}},{"deprecated":false,"digest":{"function_hash":"64296000783816469868838673352525043901","length":706},"id":"CVE-2026-22244-c24e6e92","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/adbe4431db9c861987bca681a156cb5062df0c84","target":{"function":"hasFlywayDataAlreadyMigrated","file":"openmetadata-service/src/main/java/org/openmetadata/service/migration/utils/v1110/MigrationUtil.java"}},{"deprecated":false,"digest":{"function_hash":"16257202221513505389423484831779964495","length":221},"id":"CVE-2026-22244-cd022235","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/resources/docstore/DocStoreResource.java","function":"getDocument"}},{"signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/CollectionDAO.java"},"deprecated":false,"digest":{"line_hashes":["73411552044433681774430299939123334305","82787347445451815817508358048446412866","18644257938137096310868841129498127882","225770125109626882072319817822366773696"],"threshold":0.9},"id":"CVE-2026-22244-cdb5aa76","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"106079640487777423674096768531737662947","length":700},"id":"CVE-2026-22244-d4a99674","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/util/EmailUtil.java","function":"sendMail"}},{"signature_version":"v1","source":"https://github.com/open-metadata/openmetadata/commit/d17d13cee87db139e5d8f778547174f8ee341108","target":{"file":"openmetadata-service/src/main/java/org/openmetadata/service/security/auth/BasicAuthenticator.java"},"deprecated":false,"digest":{"line_hashes":["16057735202447782873848837382374913442","106919313075444140771943491026536628731","15490053963704307366859252629300841972","42581572648433087716617675176404863903","128467656667400870018926646784688880022","138168418101904839460226289422389402254","325490253200926897423580084492910846065","161197307212147348733354851224129107737","278463695025569610539365413328522018471"],"threshold":0.9},"id":"CVE-2026-22244-da74e965","signature_type":"Line"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22244.json","vanir_signatures_modified":"2026-09-02T08:09:26Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P"}]}