OpenMetadata JWT filter matched paths by substring, and a semicolon reopened the door

A breakdown of CVE-2024-28255: OpenMetadata's JWT filter compared request paths by substring, and a matrix parameter let a request pass as a login call while the router sent it to an authenticated resource. The chain reaches SpEL injection and RCE; Microsoft observed exploitation against Kubernetes environments for cryptomining from April 2024, and ZoomEye counted 1,261 fingerprinted instances.

• CVE-2024-28255: substring path matching plus matrix-parameter normalisation bypasses authentication
• The chain leads to SpEL injection and remote code execution on the server
• CVE-2026-26010: ingestionPipelines API returned bot JWTs with Glue, Redshift and Postgres access
• ZoomEye: 1,261 OpenMetadata instances by fingerprint as of 23 October 2026