OpenMetadata versions up to 2.0.2 contain a server‑side request forgery vulnerability due to the URLValidator.validateURL function failing to resolve DNS hostnames properly. Attackers with permission to create or update EventSubscription entries can supply webhook URLs that point to arbitrary internal hosts. When a webhook is triggered, the server sends a request to the internal host and returns the HTTP status code, allowing an attacker to perform blind probing of internal networks or cloud metadata services.

The issue is specific to the OpenMetadata platform. Any installation of OpenMetadata 2.0.2 or earlier that allows users to create or modify EventSubscription objects is affected. No other vendors are listed as impacted in the CVE data.

The CVSS base score of 5.1 indicates moderate risk, and no EPSS score is available. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access to create or modify webhook URLs, so the threat is bound to authorized or insider users. Without publicly known exploitation, the risk remains moderate until further activity is observed.