OpenMetadata versions prior to 1.11.8 expose JSON Web Tokens (JWTs) issued to the ingestion‑bot when the UI calls the /api/v1/ingestionPipelines endpoint. An attacker with a read‑only account can capture these privileged tokens and use them to act as the ingestion‑bot, which has broad rights to modify pipeline configurations. The vulnerability creates a privilege escalation path that permits destructive changes to metadata, potential data leakage, and unauthorized manipulation of ingestion services. The weakness is a missing authorization check (CWE‑269).

All OpenMetadata deployments running any release older than 1.11.8 are affected. The issue impacts the UI endpoint /api/v1/ingestionPipelines and affects the ingestion‑bot identities used for Glue, Redshift, and Postgres pipelines across those releases.

The CVSS score of 7.6 indicates high severity, while the EPSS score of <1% shows a low probability of exploitation under current conditions and the vulnerability is not listed in the CISA KEV catalog. Attackers would need access to a read‑only user session to trigger the vulnerable endpoint. Once the JWT is captured, the token grants full control over ingestion pipelines, enabling schema alterations, data exports, or other destructive actions. The exploit path requires only standard UI interaction, meaning any authenticated user with read‑only privileges can potentially exploit it.