Active Kubernetes RCE Attack Relies on Known OpenMetadata Vulns

Microsoft Threat Intelligence reports that multiple vulnerabilities (CVE-2024-28255, CVE-2024-28847, CVE-2024-28253, CVE-2024-28848, CVE-2024-28254) in OpenMetadata versions prior to v1.3.1 have been actively exploited since early April to achieve remote code execution on internet-exposed Kubernetes workloads; attackers have used compromised clusters for cryptocurrency mining and could potentially conduct lateral movement. OpenMetadata and Microsoft advise applying patches (fixed in Jan/March releases), enforcing strong authentication, and resetting default credentials.