CVE-2026-100373 is a server-side request forgery vulnerability affecting OpenMetadata through version 2.0.2. The issue exists in the URLValidator.validateURL function, which fails to correctly resolve DNS hostnames and validate against internal network addresses. As a result, authorized users can configure EventSubscription webhook destinations to internal or cloud metadata endpoints. This allows the server to make unauthorized requests to internal resources, potentially exposing sensitive information or enabling further attacks. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity.

The vulnerability allows authenticated users with permission to create or update EventSubscription to cause the server to send HTTP requests to internal network resources or cloud metadata endpoints. This can lead to unauthorized access to internal services and blind SSRF probing, which may be used to gather information about internal infrastructure. There is no indication of remote unauthenticated exploitation or privilege escalation beyond the required permissions. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict permissions to create or update EventSubscription to trusted users only. Monitor for unusual webhook destination configurations and consider network-level controls to limit server outbound requests to internal or sensitive endpoints.