Hackers Exploit OpenMetadata Flaws to Mine Crypto on Kubernetes

Microsoft Threat Intelligence observed threat actors exploiting multiple high-severity OpenMetadata CVEs (SpEL injection and an auth bypass) to achieve unauthenticated RCE on internet-exposed workloads, conduct reconnaissance (including out-of-band checks to oast.me/Interactsh), deploy Windows/Linux crypto-miners, establish reverse shells, and maintain persistence via cron; users are advised to update images, avoid default credentials, and adopt strong authentication.