OpenMetadata: TEST_CONNECTION workflow leaks ingestion-bot JWT and database password to regular users
Date: 2026-05
Affected: maven/org.open-metadata:openmetadata-service
Attack vector: other
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-46481
CWE: CWE-201
CVSS: 8.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L)

**This is not applicable if an application is configuring the Secrets Store to store credentials. Please make sure to follow the best practices when deploying in production** In OpenMetadata 1.12.1, a non-admin SSO user can trigger a `TEST_CONNECTION` workflow for a Database Service and receive, in the HTTP 201 response of `POST /api/v1/automations/workflows`, both: - The cleartext database password in `request.connection.config.password`. - The ingestion bot JWT in `openMetadataServerConnection.securityConfig.jwtToken`. The leaked ingestion-bot token can then be reused as `Authorization: Bearer <jwt>` to access sensitive service APIs (for example, `GET /api/v1/services/databaseServices/{id}?include=all`) with bot-level privileges. This looks different from GHSA-pqqf-7hxm-rj5r, because it affects the `automations/workflows` TEST_CONNECTION endpoint on OpenMetadata 1.12.1, not the ingestion pipelines endpoints. --- Version / Product - Product: OpenMetadata (open source, Apache 2.0) - Version: 1.12.1 - GET /api/v1/system/version → {"version":"1.12.1","revision":"618a2dc2ec8f70ffcd0378ee14ce92cb4f98f0c5"} - Deployment: OpenMetadata server with SSO via Azure AD (OAuth), Oracle database service, secrets in DB secrets manager (`secretsManagerProvider: "db"`). --- Preconditions - Authenticated SSO user with access to the UI. - User can open a Database Service and click “Test connection”. - No server admin role, no shell/DB access. --- PoC (short) 1) Login as a regu


Mitigations:

Architectural layers (MAESTRO):