OpenMetadata Authentication Bypass (CVE-2024-28255)
Description
OpenMetadata suffers from an authentication bypass due to a JWT filter vulnerability. Attackers can manipulate path parameters to skip JWT validation, leading to unauthorized access to arbitrary endpoints, including those vulnerable to SpEL expression injection.
Remediation
Upgrade to OpenMetadata version 1.2.4 or later.