CVE-2024-28254

CVE-2024-28254 is a critical Remote Code Execution (RCE) vulnerability affecting OpenMetadata versions prior to 1.2.4. It stems from an insecure SpEL expression evaluation in the AlertUtil::validateExpression method, accessible via an unauthenticated endpoint. This allows any authenticated user, including non-administrators, to execute arbitrary system commands due to a missing authorization check and the use of StandardEvaluationContext. With a CVSS score of 8.8 (High), the vulnerability has a low attack complexity and can lead to complete compromise of confidentiality, integrity, and availability. Exploit intelligence indicates a Metasploit module exists, and there is significant community discussion and media coverage, including reports of active exploitation in Kubernetes cryptomining attacks.