Hackers hijack OpenMetadata apps in Kubernetes cryptomining attacks

Attackers are actively exploiting five critical OpenMetadata vulnerabilities (CVE-2024-28255, CVE-2024-28847, CVE-2024-28253, CVE-2024-28848, CVE-2024-28254) in internet-exposed Kubernetes workloads to achieve remote code execution, deploy cryptomining malware, open reverse shells (via netcat), and persist using cronjobs. Microsoft observed these intrusions since early April; OpenMetadata released patches in version 1.2.4 on January 5 and administrators are advised to patch, avoid exposing default credentials, and inventory OpenMetadata images in clusters.