H3-2026-1058¶
OpenMetadata Private Context Memory Search Index Exposure Vulnerability
| Category | VULNERABILITY |
| Base Score | 6.5 |
Description¶
OpenMetadata is a unified metadata platform for data catalogs and governance. Its ContextMemory feature writes Private and Shared memory documents to the Elasticsearch or OpenSearch search index without enforcing a visibility check at index time. Remote attackers who can reach the search API, including the fieldQuery and search/get endpoints, can retrieve the full contents of memory documents belonging to other users. The root cause is that visibility filtering was applied only in individual query paths rather than once at indexing time, leaving some search paths uncovered. Exploitation requires network access to the OpenMetadata search API and the ability to query the context memory search index.
Impact¶
Successful exploitation exposes private and shared memory content across the organization, including credentials and runbook data. Attackers gain organization-wide access to knowledge-base entries intended only for their owner or group. Exposure persists for any indexed memory until the index is rebuilt after the fix. Teams relying on access-controlled knowledge sharing face the greatest exposure.