Attackers exploiting new critical OpenMetadata vulnerabilities on Kubernetes clusters

Microsoft observed attackers exploiting multiple critical OpenMetadata CVEs (affecting versions prior to 1.3.1) in internet‑exposed Kubernetes workloads to achieve remote code execution, perform reconnaissance (including OAST/Interactsh callbacks), harvest environment credentials, deploy cryptomining malware, establish reverse shells and persistence via cronjobs; the report includes file and IP IoCs, Defender for Cloud detection examples, and recommends updating OpenMetadata images to 1.3.1+, removing internet exposure or enforcing strong authentication, and using provided IoCs for hunting.