Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
66 vulnerabilities by Metabase
CERTFR-2026-ALE-010
Vulnerability from certfr_alerte - Published: 2026-09-10 - Updated: 2026-09-10
Le 06 août 2026, Metabase a publié un avis de sécurité concernant une vulnérabilité critique permettant à un attaquant non authentifié de provoquer une injection SQL (SQLi) dans la base de donnée de l'application Metabase. Cette injection SQL permet d’obtenir les droits administrateur de l'instance.
Le CERT-FR a connaissance de nombreuses compromissions de Metabase vulnérables.
Recherche de compromission
Les tentatives d'exploitations sont observables dans les journaux applicatifs et les journaux Metabase. Elles sont caractérisées par la succession de ces deux requêtes :
1. POST /api/session/reset_password avec un code retour HTTP 400 ;
2. GET /api/user/current avec un code retour HTTP 200.
En cas de compromission, signaler l’événement auprès du CERT-FR en mettant en copie vos éventuels CSIRTs métier et consulter les fiches réflexes de compromission système [1][2].
Mesures de contournement
Le CERT-FR recommande l'application des correctifs dans les plus brefs délais.
Si cela n'est pas possible, Metabase recommande de bloquer l'accès public au chemin /api/session/reset_password.
Remédiation
Si le chemin d'accès /api/session/reset_password est public, l'éditeur préconise de :
* révoquer toutes les sessions utilisateur actives en accédant à la base de données de l’application Metabase et en supprimant toutes les lignes de la table core_session ;
* inspecter vos clés API et supprimer toutes les clés non reconnues ;
* inspecter les comptes administrateur afin de détecter toute modification inattendue ;
* renouveler les identifiants d’accès pour toutes les bases de données connectées ;
* inspecter les journaux pour détecter tout signe d'accès non autorisé ;
* inspecter l'historique des activités et des requêtes de Metabase pour détecter toute activité inattendue ou non autorisée.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Metabase | Metabase | metabase versions antérieures à x.58.28 | ||
| Metabase | Metabase | metabase versions x.61.x antérieures à x.61.15 | ||
| Metabase | Metabase | metabase versions x.59.x antérieures à x.59.25 | ||
| Metabase | Metabase | metabase versions antérieures à x.63.10 | ||
| Metabase | Metabase | metabase versions x.60.x antérieures à x.60.21 | ||
| Metabase | Metabase | metabase versions x.62.x antérieures à x.62.13 |
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "metabase versions ant\u00e9rieures \u00e0 x.58.28",
"product": {
"name": "Metabase",
"vendor": {
"name": "Metabase",
"scada": false
}
}
},
{
"description": "metabase versions x.61.x ant\u00e9rieures \u00e0 x.61.15",
"product": {
"name": "Metabase",
"vendor": {
"name": "Metabase",
"scada": false
}
}
},
{
"description": "metabase versions x.59.x ant\u00e9rieures \u00e0 x.59.25",
"product": {
"name": "Metabase",
"vendor": {
"name": "Metabase",
"scada": false
}
}
},
{
"description": "metabase versions ant\u00e9rieures \u00e0 x.63.10",
"product": {
"name": "Metabase",
"vendor": {
"name": "Metabase",
"scada": false
}
}
},
{
"description": "metabase versions x.60.x ant\u00e9rieures \u00e0 x.60.21",
"product": {
"name": "Metabase",
"vendor": {
"name": "Metabase",
"scada": false
}
}
},
{
"description": "metabase versions x.62.x ant\u00e9rieures \u00e0 x.62.13",
"product": {
"name": "Metabase",
"vendor": {
"name": "Metabase",
"scada": false
}
}
}
],
"affected_systems_content": "",
"closed_at": null,
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-72898",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72898"
}
],
"initial_release_date": "2026-09-10T00:00:00",
"last_revision_date": "2026-09-10T00:00:00",
"links": [
{
"title": "Bulletin d\u0027actualit\u00e9 CERTFR-2026-ACT-035",
"url": "https://www.cert.ssi.gouv.fr/actualite/CERTFR-2026-ACT-035/"
},
{
"title": "Publications de Metabase sur GitHub",
"url": "https://github.com/metabase/metabase/releases"
},
{
"title": "[1] Compromission syst\u00e8me - Qualification",
"url": "https://www.cert.ssi.gouv.fr/fiche/CERTFR-2024-RFX-005/"
},
{
"title": "Avis CERT-FR CERTFR-2026-AVI-1075 du 24 ao\u00fbt 2026",
"url": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1075/"
},
{
"title": "Bulletin d\u0027actualit\u00e9 CERTFR-2026-ACT-034",
"url": "https://www.cert.ssi.gouv.fr/actualite/CERTFR-2026-ACT-034/"
},
{
"title": "[2] Compromission syst\u00e8me - Endiguement",
"url": "https://www.cert.ssi.gouv.fr/fiche/CERTFR-2024-RFX-006/"
}
],
"reference": "CERTFR-2026-ALE-010",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-09-10T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection SQL (SQLi)"
}
],
"summary": "Le 06 ao\u00fbt 2026, Metabase a publi\u00e9 un avis de s\u00e9curit\u00e9 concernant une vuln\u00e9rabilit\u00e9 critique permettant \u00e0 un attaquant non authentifi\u00e9 de provoquer une injection SQL (SQLi) dans la base de donn\u00e9e de l\u0027application Metabase. Cette injection SQL permet d\u2019obtenir les droits administrateur de l\u0027instance. \n\nLe CERT-FR a connaissance de nombreuses compromissions de Metabase vuln\u00e9rables.\n\n## Recherche de compromission\n\nLes tentatives d\u0027exploitations sont observables dans les journaux applicatifs et les journaux Metabase. Elles sont caract\u00e9ris\u00e9es par la succession de ces deux requ\u00eates : \n1. \u003ccode\u003ePOST /api/session/reset_password\u003c/code\u003e avec un code retour HTTP 400 ;\n2. \u003ccode\u003eGET /api/user/current\u003c/code\u003e avec un code retour HTTP 200.\n\nEn cas de compromission, \u003ca href=\"https://www.cert.ssi.gouv.fr/contact/\"\u003esignaler\u003c/a\u003e l\u2019\u00e9v\u00e9nement aupr\u00e8s du CERT-FR en mettant en copie vos \u00e9ventuels CSIRTs m\u00e9tier et consulter les fiches r\u00e9flexes de compromission syst\u00e8me [1][2].\n\n## Mesures de contournement\n\nLe CERT-FR recommande l\u0027application des correctifs dans les plus brefs d\u00e9lais.\n\nSi cela n\u0027est pas possible, Metabase recommande de bloquer l\u0027acc\u00e8s public au chemin \u003ccode\u003e/api/session/reset_password\u003c/code\u003e.\n\n## Rem\u00e9diation\n\nSi le chemin d\u0027acc\u00e8s \u003ccode\u003e/api/session/reset_password\u003c/code\u003e est public, l\u0027\u00e9diteur pr\u00e9conise de :\n* r\u00e9voquer toutes les sessions utilisateur actives en acc\u00e9dant \u00e0 la base de donn\u00e9es de l\u2019application Metabase et en supprimant toutes les lignes de la table \u003ccode\u003ecore_session\u003c/code\u003e ;\n* inspecter vos cl\u00e9s API et supprimer toutes les cl\u00e9s non reconnues ;\n* inspecter les comptes administrateur afin de d\u00e9tecter toute modification inattendue ;\n* renouveler les identifiants d\u2019acc\u00e8s pour toutes les bases de donn\u00e9es connect\u00e9es ;\n* inspecter les journaux pour d\u00e9tecter tout signe d\u0027acc\u00e8s non autoris\u00e9 ;\n* inspecter l\u0027historique des activit\u00e9s et des requ\u00eates de Metabase pour d\u00e9tecter toute activit\u00e9 inattendue ou non autoris\u00e9e.",
"title": "Vuln\u00e9rabilit\u00e9 dans Metabase",
"vendor_advisories": [
{
"published_at": "2026-08-06",
"title": "Bulletin de s\u00e9curit\u00e9 Metabase",
"url": "https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf"
},
{
"published_at": "2026-08-27",
"title": "Article de blogue de Metabase",
"url": "https://www.metabase.com/blog/vulnerability-what-happened"
},
{
"published_at": "2026-08-06",
"title": "Article de blogue de Metabase",
"url": "https://www.metabase.com/blog/security-update-6-aug-2026"
}
]
}
CVE-2026-86116 (GCVE-0-2026-86116)
Vulnerability from nvd – Published: 2026-09-05 09:59 – Updated: 2026-09-08 17:26
VLAI
EPSS
VEX
Title
Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API
Summary
Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business glossary data without proper authorization.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 17:26 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/geo-chen/oss/blob/main/metabase.md | technical-description |
| https://github.com/metabase/metabase/blob/v0.62.1… | technical-description |
| https://github.com/metabase/metabase/commit/0a058… | patch |
| https://github.com/metabase/metabase/releases/tag… | release-notes |
| https://github.com/metabase/metabase | product |
| https://www.vulncheck.com/advisories/metabase-bef… | third-party-advisory |
Impacted products
Date Public
2026-09-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86116",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T17:26:29.950481Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T17:26:40.648Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/metabase/metabase",
"product": "metabase",
"repo": "https://github.com/metabase/metabase",
"vendor": "metabase",
"versions": [
{
"lessThan": "0.63.1",
"status": "affected",
"version": "0.57.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.63.1",
"versionStartIncluding": "0.57.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "George Chen"
}
],
"datePublic": "2026-09-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business glossary data without proper authorization."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-05T09:59:06.683Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher write-up",
"tags": [
"technical-description"
],
"url": "https://github.com/geo-chen/oss/blob/main/metabase.md"
},
{
"name": "Glossary POST/PUT/DELETE with no authorization check",
"tags": [
"technical-description"
],
"url": "https://github.com/metabase/metabase/blob/v0.62.1/src/metabase/glossary/api.clj"
},
{
"name": "Restrict glossary permissions (#76275)",
"tags": [
"patch"
],
"url": "https://github.com/metabase/metabase/commit/0a0589299cfd"
},
{
"name": "metabase v0.63.1 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/metabase/metabase/releases/tag/v0.63.1"
},
{
"tags": [
"product"
],
"url": "https://github.com/metabase/metabase"
},
{
"name": "VulnCheck Advisory: Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/metabase-before-0.63.1-missing-function-level-authorization-on-the-glossary-management-api"
}
],
"title": "Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86116",
"datePublished": "2026-09-05T09:59:06.683Z",
"dateReserved": "2026-09-05T01:59:20.944Z",
"dateUpdated": "2026-09-08T17:26:40.648Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72900 (GCVE-0-2026-72900)
Vulnerability from nvd – Published: 2026-08-10 17:56 – Updated: 2026-08-10 20:04
VLAI
EPSS
VEX
Title
Metabase information exposure
Summary
Metabase allows an authenticated, low-privileged attacker to read the entire Metabase application database.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · cisa-cg (v2.0.3)
Decision recorded 2026-08-10 17:20 UTC
CWE
- CWE-862 - Missing Authorization
References
3 references
| URL | Tags |
|---|---|
| https://github.com/metabase/metabase/security/adv… | vendor-advisory |
| https://www.cve.org/CVERecord?id=CVE-2026-72900 | vdb-entry |
| https://raw.githubusercontent.com/cisagov/CSAF/de… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Metabase | Metabase |
Affected:
x.58.0 , < x.58.24
(custom)
Unaffected: x.58.24 Affected: x.59.0 , < x.59.21 (custom) Unaffected: x.59.21 Affected: x.60.0 , < x.60.17 (custom) Unaffected: x.60.17 Affected: x.61.0 , < x.61.11 (custom) Unaffected: x.61.11 Affected: x.62.0 , < x.62.9 (custom) Unaffected: x.62.9 Affected: x.63.0 , < x.63.5 (custom) Unaffected: x.63.5 |
Date Public
2026-08-06 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72900",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T20:04:25.578746Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T20:04:45.028Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Metabase",
"vendor": "Metabase",
"versions": [
{
"lessThan": "x.58.24",
"status": "affected",
"version": "x.58.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "x.58.24"
},
{
"lessThan": "x.59.21",
"status": "affected",
"version": "x.59.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "x.59.21"
},
{
"lessThan": "x.60.17",
"status": "affected",
"version": "x.60.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "x.60.17"
},
{
"lessThan": "x.61.11",
"status": "affected",
"version": "x.61.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "x.61.11"
},
{
"lessThan": "x.62.9",
"status": "affected",
"version": "x.62.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "x.62.9"
},
{
"lessThan": "x.63.5",
"status": "affected",
"version": "x.63.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "x.63.5"
}
]
}
],
"datePublic": "2026-08-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Metabase allows an authenticated, low-privileged attacker to read the entire Metabase application database."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
},
{
"other": {
"content": {
"id": "CVE-2026-72900",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T17:20:03.619417Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T17:56:23.099Z",
"orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"shortName": "cisa-cg"
},
"references": [
{
"name": "url",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/metabase/metabase/security/advisories/GHSA-8hmm-hrhg-ppqp"
},
{
"name": "url",
"tags": [
"vdb-entry"
],
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72900"
},
{
"name": "url",
"tags": [
"third-party-advisory"
],
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-222-01.json"
}
],
"title": "Metabase information exposure"
}
},
"cveMetadata": {
"assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"assignerShortName": "cisa-cg",
"cveId": "CVE-2026-72900",
"datePublished": "2026-08-10T17:56:23.099Z",
"dateReserved": "2026-08-10T17:21:18.799Z",
"dateUpdated": "2026-08-10T20:04:45.028Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72899 (GCVE-0-2026-72899)
Vulnerability from nvd – Published: 2026-08-10 17:56 – Updated: 2026-08-11 03:55
VLAI
EPSS
VEX
Title
Metabase SQL injection via public card or dashboard
Summary
Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · cisa-cg (v2.0.3)
Decision recorded 2026-08-10 17:19 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
References
3 references
| URL | Tags |
|---|---|
| https://github.com/metabase/metabase/security/adv… | vendor-advisory |
| https://www.cve.org/CVERecord?id=CVE-2026-72899 | vdb-entry |
| https://raw.githubusercontent.com/cisagov/CSAF/de… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Metabase | Metabase |
Affected:
x.58.0 , < x.58.24
(custom)
Unaffected: x.58.24 Affected: x.59.0 , < x.59.21 (custom) Unaffected: x.59.21 Affected: x.60.0 , < x.60.17 (custom) Unaffected: x.60.17 Affected: x.61.0 , < x.61.11 (custom) Unaffected: x.61.11 Affected: x.62.0 , < x.62.9 (custom) Unaffected: x.62.9 Affected: x.63.0 , < x.63.5 (custom) Unaffected: x.63.5 |
Date Public
2026-08-06 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72899",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T03:55:38.382Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Metabase",
"vendor": "Metabase",
"versions": [
{
"lessThan": "x.58.24",
"status": "affected",
"version": "x.58.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "x.58.24"
},
{
"lessThan": "x.59.21",
"status": "affected",
"version": "x.59.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "x.59.21"
},
{
"lessThan": "x.60.17",
"status": "affected",
"version": "x.60.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "x.60.17"
},
{
"lessThan": "x.61.11",
"status": "affected",
"version": "x.61.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "x.61.11"
},
{
"lessThan": "x.62.9",
"status": "affected",
"version": "x.62.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "x.62.9"
},
{
"lessThan": "x.63.5",
"status": "affected",
"version": "x.63.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "x.63.5"
}
]
}
],
"datePublic": "2026-08-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
},
{
"other": {
"content": {
"id": "CVE-2026-72899",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T17:19:15.173020Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T17:56:09.950Z",
"orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"shortName": "cisa-cg"
},
"references": [
{
"name": "url",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/metabase/metabase/security/advisories/GHSA-r8h2-qpfx-mx59"
},
{
"name": "url",
"tags": [
"vdb-entry"
],
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72899"
},
{
"name": "url",
"tags": [
"third-party-advisory"
],
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-222-01.json"
}
],
"title": "Metabase SQL injection via public card or dashboard"
}
},
"cveMetadata": {
"assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"assignerShortName": "cisa-cg",
"cveId": "CVE-2026-72899",
"datePublished": "2026-08-10T17:56:09.950Z",
"dateReserved": "2026-08-10T17:21:11.759Z",
"dateUpdated": "2026-08-11T03:55:38.382Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72898 (GCVE-0-2026-72898)
Vulnerability from nvd – Published: 2026-08-10 17:55 – Updated: 2026-08-12 14:50Title
Metabase SQL injection via password reset endpoint
Summary
Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.
Severity
10 (Critical)
SSVC
Exploitation: active
Automatable: yes
Technical Impact: total
CISA Coordinator · cisa-cg (v2.0.3)
Decision recorded 2026-08-10 17:14 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
References
5 references
| URL | Tags |
|---|---|
| https://github.com/metabase/metabase/security/adv… | vendor-advisory |
| https://www.metabase.com/blog/security-update | vendor-advisory |
| https://www.cve.org/CVERecord?id=CVE-2026-72898 | vdb-entry |
| https://raw.githubusercontent.com/cisagov/CSAF/de… | third-party-advisory |
| https://www.cisa.gov/known-exploited-vulnerabilit… | government-resource |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Metabase | Metabase |
Affected:
x.58.0 , < x.58.24
(custom)
Unaffected: x.58.24 Affected: x.59.0 , < x.59.21 (custom) Unaffected: x.59.21 Affected: x.60.0 , < x.60.17 (custom) Unaffected: x.60.17 Affected: x.61.0 , < x.61.11 (custom) Unaffected: x.61.11 Affected: x.62.0 , < x.62.9 (custom) Unaffected: x.62.9 Affected: x.63.0 , < x.63.5 (custom) Unaffected: x.63.5 |
Date Public
2026-08-06 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72898",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T03:59:47.802633Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2026-08-11",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-72898"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T14:50:08.735Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-72898"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Metabase",
"vendor": "Metabase",
"versions": [
{
"lessThan": "x.58.24",
"status": "affected",
"version": "x.58.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "x.58.24"
},
{
"lessThan": "x.59.21",
"status": "affected",
"version": "x.59.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "x.59.21"
},
{
"lessThan": "x.60.17",
"status": "affected",
"version": "x.60.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "x.60.17"
},
{
"lessThan": "x.61.11",
"status": "affected",
"version": "x.61.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "x.61.11"
},
{
"lessThan": "x.62.9",
"status": "affected",
"version": "x.62.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "x.62.9"
},
{
"lessThan": "x.63.5",
"status": "affected",
"version": "x.63.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "x.63.5"
}
]
}
],
"datePublic": "2026-08-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the \u0027/reset_password\u0027 database endpoint and gain administrator access to the connected Metabase instance."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-72898",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T17:14:52.872411Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T17:55:54.841Z",
"orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"shortName": "cisa-cg"
},
"references": [
{
"name": "url",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf"
},
{
"name": "url",
"tags": [
"vendor-advisory"
],
"url": "https://www.metabase.com/blog/security-update"
},
{
"name": "url",
"tags": [
"vdb-entry"
],
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72898"
},
{
"name": "url",
"tags": [
"third-party-advisory"
],
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-222-01.json"
}
],
"title": "Metabase SQL injection via password reset endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"assignerShortName": "cisa-cg",
"cveId": "CVE-2026-72898",
"datePublished": "2026-08-10T17:55:54.841Z",
"dateReserved": "2026-08-10T17:20:39.650Z",
"dateUpdated": "2026-08-12T14:50:08.735Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-50148 (GCVE-0-2026-50148)
Vulnerability from nvd – Published: 2026-07-15 15:18 – Updated: 2026-07-20 14:55
VLAI
EPSS
VEX
Title
Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write
Summary
Metabase is an open-source business intelligence and embedded analytics tool. From 1.54.0 until 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4, a Metabase user with permission to add or edit a database connection can achieve remote code execution on the Metabase server by configuring a Snowflake connection to an attacker-controlled server, because a flaw in the Snowflake JDBC driver can write arbitrary files anywhere on the Metabase host, including replacing one of Metabase's own database driver files that later executes inside the Metabase process. This issue is fixed in versions 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-20 14:54 UTC
CWE
- CWE-73 - External Control of File Name or Path
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/metabase/metabase/security/adv… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-50148",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-20T14:54:57.235870Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T14:55:07.812Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "metabase",
"vendor": "metabase",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.54.0, \u003c 1.54.24"
},
{
"status": "affected",
"version": "\u003e= 1.55.0, \u003c 1.55.24"
},
{
"status": "affected",
"version": "\u003e= 1.56.0, \u003c 1.56.25"
},
{
"status": "affected",
"version": "\u003e= 1.57.0, \u003c 1.57.19"
},
{
"status": "affected",
"version": "\u003e= 1.58.0, \u003c 1.58.14"
},
{
"status": "affected",
"version": "\u003e= 1.59.0, \u003c 1.59.10"
},
{
"status": "affected",
"version": "\u003e= 1.60.0, \u003c 1.60.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Metabase is an open-source business intelligence and embedded analytics tool. From 1.54.0 until 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4, a Metabase user with permission to add or edit a database connection can achieve remote code execution on the Metabase server by configuring a Snowflake connection to an attacker-controlled server, because a flaw in the Snowflake JDBC driver can write arbitrary files anywhere on the Metabase host, including replacing one of Metabase\u0027s own database driver files that later executes inside the Metabase process. This issue is fixed in versions 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "CWE-73: External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T15:18:04.142Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/metabase/metabase/security/advisories/GHSA-r6x2-rchx-q9g9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/metabase/metabase/security/advisories/GHSA-r6x2-rchx-q9g9"
}
],
"source": {
"advisory": "GHSA-r6x2-rchx-q9g9",
"discovery": "UNKNOWN"
},
"title": "Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-50148",
"datePublished": "2026-07-15T15:18:04.142Z",
"dateReserved": "2026-06-03T18:49:32.276Z",
"dateUpdated": "2026-07-20T14:55:07.812Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-50147 (GCVE-0-2026-50147)
Vulnerability from nvd – Published: 2026-07-15 15:21 – Updated: 2026-07-15 16:04
VLAI
EPSS
VEX
Title
Metabase: Arbitrary File Read via MySQL Connection Property Injection
Summary
Metabase is an open-source business intelligence and embedded analytics tool. From 1.57.0 until 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4, an attacker who can configure a Metabase database connection can read arbitrary files from the Metabase server's filesystem by adding unsafe JDBC parameters to a MySQL or MariaDB connection, causing the driver to read files from the Metabase host and expose the contents through queries against the connected database or through validation error messages. This issue is fixed in versions 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4.
Severity
7.6 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-15 16:03 UTC
CWE
- CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/metabase/metabase/security/adv… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-50147",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-15T16:03:56.744985Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T16:04:03.343Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "metabase",
"vendor": "metabase",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.57.0, \u003c 1.57.19.1"
},
{
"status": "affected",
"version": "\u003e= 1.58.0, \u003c 1.58.14.1"
},
{
"status": "affected",
"version": "\u003e= 1.59.0, \u003c 1.59.10"
},
{
"status": "affected",
"version": "\u003e= 1.60.0, \u003c 1.60.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Metabase is an open-source business intelligence and embedded analytics tool. From 1.57.0 until 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4, an attacker who can configure a Metabase database connection can read arbitrary files from the Metabase server\u0027s filesystem by adding unsafe JDBC parameters to a MySQL or MariaDB connection, causing the driver to read files from the Metabase host and expose the contents through queries against the connected database or through validation error messages. This issue is fixed in versions 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-88",
"description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T15:21:23.107Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/metabase/metabase/security/advisories/GHSA-mfpj-crjq-xrcp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/metabase/metabase/security/advisories/GHSA-mfpj-crjq-xrcp"
}
],
"source": {
"advisory": "GHSA-mfpj-crjq-xrcp",
"discovery": "UNKNOWN"
},
"title": "Metabase: Arbitrary File Read via MySQL Connection Property Injection"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-50147",
"datePublished": "2026-07-15T15:21:23.107Z",
"dateReserved": "2026-06-03T18:49:32.276Z",
"dateUpdated": "2026-07-15T16:04:03.343Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59827 (GCVE-0-2026-59827)
Vulnerability from nvd – Published: 2026-07-09 17:43 – Updated: 2026-07-09 18:24
VLAI
EPSS
VEX
Title
Metabase: Unsafe Deserialization of H2 Query Results
Summary
Metabase is an open-source business intelligence and embedded analytics tool. Prior to 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4, Metabase instances with an H2 database connection, including the default sample database, deserialize arbitrary Java objects returned in H2 native query result columns of type OTHER without validation, allowing an authenticated user who can run native H2 queries to execute code on the Metabase server. This issue is fixed in versions 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-09 18:21 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/metabase/metabase/security/adv… | x_refsource_CONFIRM |
| https://github.com/metabase/metabase/commit/00f42… | x_refsource_MISC |
| https://github.com/metabase/metabase/releases/tag… | x_refsource_MISC |
| https://github.com/metabase/metabase/releases/tag… | x_refsource_MISC |
| https://github.com/metabase/metabase/releases/tag… | x_refsource_MISC |
| https://github.com/metabase/metabase/releases/tag… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59827",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-09T18:21:29.850266Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T18:24:48.433Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "metabase",
"vendor": "metabase",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.58.0, \u003c 1.58.15"
},
{
"status": "affected",
"version": "\u003e= 1.59.0, \u003c 1.59.12"
},
{
"status": "affected",
"version": "\u003e= 1.60.0, \u003c 1.60.6.3"
},
{
"status": "affected",
"version": "\u003e= 1.61.0, \u003c 1.61.1.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Metabase is an open-source business intelligence and embedded analytics tool. Prior to 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4, Metabase instances with an H2 database connection, including the default sample database, deserialize arbitrary Java objects returned in H2 native query result columns of type OTHER without validation, allowing an authenticated user who can run native H2 queries to execute code on the Metabase server. This issue is fixed in versions 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502: Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T17:43:57.546Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/metabase/metabase/security/advisories/GHSA-w95f-x9v9-wv36",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/metabase/metabase/security/advisories/GHSA-w95f-x9v9-wv36"
},
{
"name": "https://github.com/metabase/metabase/commit/00f42511fe3bc4385652a2e96862ee6fd7d42cf8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/metabase/metabase/commit/00f42511fe3bc4385652a2e96862ee6fd7d42cf8"
},
{
"name": "https://github.com/metabase/metabase/releases/tag/v0.58.15",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/metabase/metabase/releases/tag/v0.58.15"
},
{
"name": "https://github.com/metabase/metabase/releases/tag/v0.59.12",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/metabase/metabase/releases/tag/v0.59.12"
},
{
"name": "https://github.com/metabase/metabase/releases/tag/v0.60.6.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/metabase/metabase/releases/tag/v0.60.6.3"
},
{
"name": "https://github.com/metabase/metabase/releases/tag/v0.61.1.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/metabase/metabase/releases/tag/v0.61.1.4"
}
],
"source": {
"advisory": "GHSA-w95f-x9v9-wv36",
"discovery": "UNKNOWN"
},
"title": "Metabase: Unsafe Deserialization of H2 Query Results"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-59827",
"datePublished": "2026-07-09T17:43:57.546Z",
"dateReserved": "2026-07-07T15:00:50.979Z",
"dateUpdated": "2026-07-09T18:24:48.433Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59826 (GCVE-0-2026-59826)
Vulnerability from nvd – Published: 2026-07-09 17:46 – Updated: 2026-07-10 03:55
VLAI
EPSS
VEX
Title
Metabase: Arbitrary Code Execution via Database Connection Detail Bypass
Summary
Metabase is an open-source business intelligence and embedded analytics tool. From 1.55.0 until 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2, Metabase did not validate unsafe H2 connection properties on one database-creation code path, allowing an authenticated administrator to register a crafted H2 database connection and execute arbitrary Java code on the Metabase server. This issue is fixed in versions 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-09 00:00 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/metabase/metabase/security/adv… | x_refsource_CONFIRM |
| https://github.com/metabase/metabase/commit/74032… | x_refsource_MISC |
| https://github.com/metabase/metabase/releases/tag… | x_refsource_MISC |
| https://github.com/metabase/metabase/releases/tag… | x_refsource_MISC |
| https://github.com/metabase/metabase/releases/tag… | x_refsource_MISC |
| https://github.com/metabase/metabase/releases/tag… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59826",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-09T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T03:55:49.067Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "metabase",
"vendor": "metabase",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.55.0, \u003c 1.58.15.1"
},
{
"status": "affected",
"version": "\u003e= 1.59.0, \u003c 1.59.12"
},
{
"status": "affected",
"version": "\u003e= 1.60.0, \u003c 1.60.6.3"
},
{
"status": "affected",
"version": "\u003e= 1.61.0, \u003c 1.61.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Metabase is an open-source business intelligence and embedded analytics tool. From 1.55.0 until 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2, Metabase did not validate unsafe H2 connection properties on one database-creation code path, allowing an authenticated administrator to register a crafted H2 database connection and execute arbitrary Java code on the Metabase server. This issue is fixed in versions 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T17:46:36.365Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/metabase/metabase/security/advisories/GHSA-8wx2-rxp2-4x35",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/metabase/metabase/security/advisories/GHSA-8wx2-rxp2-4x35"
},
{
"name": "https://github.com/metabase/metabase/commit/74032e5e0a5a70dc45a6a744d37b9ba24eee8d01",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/metabase/metabase/commit/74032e5e0a5a70dc45a6a744d37b9ba24eee8d01"
},
{
"name": "https://github.com/metabase/metabase/releases/tag/v0.58.15.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/metabase/metabase/releases/tag/v0.58.15.1"
},
{
"name": "https://github.com/metabase/metabase/releases/tag/v0.59.12",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/metabase/metabase/releases/tag/v0.59.12"
},
{
"name": "https://github.com/metabase/metabase/releases/tag/v0.60.6.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/metabase/metabase/releases/tag/v0.60.6.3"
},
{
"name": "https://github.com/metabase/metabase/releases/tag/v0.61.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/metabase/metabase/releases/tag/v0.61.2"
}
],
"source": {
"advisory": "GHSA-8wx2-rxp2-4x35",
"discovery": "UNKNOWN"
},
"title": "Metabase: Arbitrary Code Execution via Database Connection Detail Bypass"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-59826",
"datePublished": "2026-07-09T17:46:36.365Z",
"dateReserved": "2026-07-07T15:00:50.979Z",
"dateUpdated": "2026-07-10T03:55:49.067Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33725 (GCVE-0-2026-33725)
Vulnerability from nvd – Published: 2026-03-27 00:19 – Updated: 2026-03-28 03:55
VLAI
EPSS
VEX
Title
Metabase vulnerable to RCE and Arbitrary File Read via H2 JDBC INIT Injection in EE Serialization Import
Summary
Metabase is an open source business intelligence and embedded analytics tool. In Metabase Enterprise prior to versions 1.54.22, 1.55.22, 1.56.22, 1.57.16, 1.58.10, and 1.59.4, authenticated admins on Metabase Enterprise Edition can achieve Remote Code Execution (RCE) and Arbitrary File Read via the `POST /api/ee/serialization/import` endpoint. A crafted serialization archive injects an `INIT` property into the H2 JDBC spec, which can execute arbitrary SQL during a database sync. We confirmed this was possible on Metabase Cloud. This only affects Metabase Enterprise. Metabase OSS lacks the affected codepaths. All versions of Metabase Enterprise that have serialization, which dates back to at least version 1.47, are affected. Metabase Enterprise versions 1.54.22, 1.55.22, 1.56.22, 1.57.16, 1.58.10, and 1.59.4 patch the issue. As a workaround, disable the serialization import endpoint in their Metabase instance to prevent access to the vulnerable codepaths.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-27 00:00 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/metabase/metabase/security/adv… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33725",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-27T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-28T03:55:51.956Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "metabase",
"vendor": "metabase",
"versions": [
{
"status": "affected",
"version": "\u003c 1.54.22"
},
{
"status": "affected",
"version": "\u003e= 1.55.0, \u003c 1.55.22"
},
{
"status": "affected",
"version": "\u003e= 1.56.0, \u003c 1.56.22"
},
{
"status": "affected",
"version": "\u003e= 1.57.0, \u003c 1.57.16"
},
{
"status": "affected",
"version": "\u003e= 1.58.0, \u003c 1.58.10"
},
{
"status": "affected",
"version": "\u003e= 1.59.0, \u003c 1.59.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Metabase is an open source business intelligence and embedded analytics tool. In Metabase Enterprise prior to versions 1.54.22, 1.55.22, 1.56.22, 1.57.16, 1.58.10, and 1.59.4, authenticated admins on Metabase Enterprise Edition can achieve Remote Code Execution (RCE) and Arbitrary File Read via the `POST /api/ee/serialization/import` endpoint. A crafted serialization archive injects an `INIT` property into the H2 JDBC spec, which can execute arbitrary SQL during a database sync. We confirmed this was possible on Metabase Cloud. This only affects Metabase Enterprise. Metabase OSS lacks the affected codepaths. All versions of Metabase Enterprise that have serialization, which dates back to at least version 1.47, are affected. Metabase Enterprise versions 1.54.22, 1.55.22, 1.56.22, 1.57.16, 1.58.10, and 1.59.4 patch the issue. As a workaround, disable the serialization import endpoint in their Metabase instance to prevent access to the vulnerable codepaths."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502: Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-27T00:19:39.397Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/metabase/metabase/security/advisories/GHSA-fppj-vcm3-w229",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/metabase/metabase/security/advisories/GHSA-fppj-vcm3-w229"
}
],
"source": {
"advisory": "GHSA-fppj-vcm3-w229",
"discovery": "UNKNOWN"
},
"title": "Metabase vulnerable to RCE and Arbitrary File Read via H2 JDBC INIT Injection in EE Serialization Import"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33725",
"datePublished": "2026-03-27T00:19:39.397Z",
"dateReserved": "2026-03-23T17:34:57.559Z",
"dateUpdated": "2026-03-28T03:55:51.956Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-27464 (GCVE-0-2026-27464)
Vulnerability from nvd – Published: 2026-02-21 07:57 – Updated: 2026-02-24 18:51
VLAI
EPSS
VEX
Title
Metabase: Server-Side Template Injection via Notifications Endpoint Leads to RCE
Summary
Metabase is an open-source data analytics platform. In versions prior to 0.57.13 and versions 0.58.x through 0.58.6, authenticated users are able to retrieve sensitive information from a Metabase instance, including database access credentials. During testing, it was confirmed that a low-privileged user can extract sensitive information including database credentials, into the email body via template evaluation. This issue has been fixed in versions 0.57.13 and 0.58.7. To workaround this issue, users can disable notifications in their Metabase instance to disallow access to the vulnerable endpoints.
Severity
7.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-24 18:50 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/metabase/metabase/security/adv… | x_refsource_CONFIRM |
| https://github.com/metabase/metabase/releases/tag… | x_refsource_MISC |
| https://github.com/metabase/metabase/releases/tag… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-27464",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-24T18:50:49.320406Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T18:51:05.408Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "metabase",
"vendor": "metabase",
"versions": [
{
"status": "affected",
"version": "\u003c 0.57.13"
},
{
"status": "affected",
"version": "\u003e= 0.58.x, \u003c 0.58.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Metabase is an open-source data analytics platform. In versions prior to 0.57.13 and versions 0.58.x through 0.58.6, authenticated users are able to retrieve sensitive information from a Metabase instance, including database access credentials. During testing, it was confirmed that a low-privileged user can extract sensitive information including database credentials, into the email body via template evaluation. This issue has been fixed in versions 0.57.13 and 0.58.7. To workaround this issue, users can disable notifications in their Metabase instance to disallow access to the vulnerable endpoints."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-21T07:57:50.957Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/metabase/metabase/security/advisories/GHSA-vcj8-rcm8-gfj9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/metabase/metabase/security/advisories/GHSA-vcj8-rcm8-gfj9"
},
{
"name": "https://github.com/metabase/metabase/releases/tag/v0.57.13",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/metabase/metabase/releases/tag/v0.57.13"
},
{
"name": "https://github.com/metabase/metabase/releases/tag/v0.58.7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/metabase/metabase/releases/tag/v0.58.7"
}
],
"source": {
"advisory": "GHSA-vcj8-rcm8-gfj9",
"discovery": "UNKNOWN"
},
"title": "Metabase: Server-Side Template Injection via Notifications Endpoint Leads to RCE"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-27464",
"datePublished": "2026-02-21T07:57:50.957Z",
"dateReserved": "2026-02-19T17:25:31.101Z",
"dateUpdated": "2026-02-24T18:51:05.408Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-22805 (GCVE-0-2026-22805)
Vulnerability from nvd – Published: 2026-01-12 22:36 – Updated: 2026-01-13 19:07
VLAI
EPSS
VEX
Title
Metabase channel test endpoint can reach internal local addresses
Summary
Metabase is an open-source data analytics platform. Prior to 55.13, 56.3, and 57.1, self-hosted Metabase instances that allow users to create subscriptions could be potentially impacted if their Metabase is colocated with other unsecured resources. This vulnerability is fixed in 55.13, 56.3, and 57.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-13 14:13 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/metabase/metabase/security/adv… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22805",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-13T14:13:44.384619Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-13T19:07:47.948Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "metabase",
"vendor": "metabase",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.57.0-beta, \u003c 57.1"
},
{
"status": "affected",
"version": "\u003e= 0.56.0-beta, \u003c 56.3"
},
{
"status": "affected",
"version": "\u003c 55.13"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Metabase is an open-source data analytics platform. Prior to 55.13, 56.3, and 57.1, self-hosted Metabase instances that allow users to create subscriptions could be potentially impacted if their Metabase is colocated with other unsecured resources. This vulnerability is fixed in 55.13, 56.3, and 57.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-12T22:36:35.272Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/metabase/metabase/security/advisories/GHSA-2wgg-7r2p-cmqx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/metabase/metabase/security/advisories/GHSA-2wgg-7r2p-cmqx"
}
],
"source": {
"advisory": "GHSA-2wgg-7r2p-cmqx",
"discovery": "UNKNOWN"
},
"title": "Metabase channel test endpoint can reach internal local addresses"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-22805",
"datePublished": "2026-01-12T22:36:35.272Z",
"dateReserved": "2026-01-09T22:50:10.287Z",
"dateUpdated": "2026-01-13T19:07:47.948Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-5895 (GCVE-0-2025-5895)
Vulnerability from nvd – Published: 2025-06-09 20:00 – Updated: 2025-06-10 15:30
VLAI
EPSS
VEX
Title
Metabase dom.js parseDataUri redos
Summary
A vulnerability was found in Metabase 54.10. It has been classified as problematic. This affects the function parseDataUri of the file frontend/src/metabase/lib/dom.js. The manipulation leads to inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The patch is named 4454ebbdc7719016bf80ca0f34859ce5cee9f6b0. It is recommended to apply a patch to fix this issue.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-10 14:23 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.311667 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.311667 | signaturepermissions-required |
| https://vuldb.com/?submit.585795 | third-party-advisory |
| https://github.com/metabase/metabase/pull/57011 | issue-tracking |
| https://github.com/metabase/metabase/pull/57011#p… | exploitissue-tracking |
| https://github.com/metabase/metabase/commit/4454e… | patch |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-5895",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-10T14:23:31.679790Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-10T15:30:32.919Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/metabase/metabase/pull/57011"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Metabase",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "54.10"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "mmmsssttt (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Metabase 54.10. It has been classified as problematic. This affects the function parseDataUri of the file frontend/src/metabase/lib/dom.js. The manipulation leads to inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The patch is named 4454ebbdc7719016bf80ca0f34859ce5cee9f6b0. It is recommended to apply a patch to fix this issue."
},
{
"lang": "de",
"value": "Es wurde eine Schwachstelle in Metabase 54.10 ausgemacht. Sie wurde als problematisch eingestuft. Es geht dabei um die Funktion parseDataUri der Datei frontend/src/metabase/lib/dom.js. Durch Manipulation mit unbekannten Daten kann eine inefficient regular expression complexity-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung. Der Patch wird als 4454ebbdc7719016bf80ca0f34859ce5cee9f6b0 bezeichnet. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "Inefficient Regular Expression Complexity",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-09T20:00:19.261Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-311667 | Metabase dom.js parseDataUri redos",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.311667"
},
{
"name": "VDB-311667 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.311667"
},
{
"name": "Submit #585795 | metabase @metabase 54.10 Inefficient Regular Expression Complexity",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.585795"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/metabase/metabase/pull/57011"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/metabase/metabase/pull/57011#pullrequestreview-2792664135"
},
{
"tags": [
"patch"
],
"url": "https://github.com/metabase/metabase/commit/4454ebbdc7719016bf80ca0f34859ce5cee9f6b0"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-06-09T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-06-09T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-06-09T08:52:20.000Z",
"value": "VulDB entry last update"
}
],
"title": "Metabase dom.js parseDataUri redos"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-5895",
"datePublished": "2025-06-09T20:00:19.261Z",
"dateReserved": "2025-06-09T06:47:00.425Z",
"dateUpdated": "2025-06-10T15:30:32.919Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-32382 (GCVE-0-2025-32382)
Vulnerability from nvd – Published: 2025-04-10 14:40 – Updated: 2025-04-10 15:23
VLAI
EPSS
VEX
Title
Snowflake credentials logged by the Metabase backend
Summary
Metabase is an open source Business Intelligence and Embedded Analytics tool. When admins change Snowflake connection details in Metabase (either updating a password or changing password to private key or vice versa), Metabase would not always purge older Snowflake connection details from the application database. In order to remove older and stale connection details, Metabase would try one connection method at a time and purge all the other connection methods from the application database. When Metabase found a connection that worked, it would log (log/infof "Successfully connected, migrating to: %s" (pr-str test-details)) which would then print the username and password to the logger. This is fixed in 52.17.1, 53.9.5 and 54.1.5 in both the OSS and enterprise editions. Versions 51 and lower are not impacted.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-10 15:23 UTC
CWE
- CWE-532 - Insertion of Sensitive Information into Log File
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/metabase/metabase/security/adv… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-32382",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-10T15:23:05.467005Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-10T15:23:19.566Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "metabase",
"vendor": "metabase",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.52.12, \u003c 0.52.17.1"
},
{
"status": "affected",
"version": "\u003e= 1.52.12, \u003c 1.52.17.1"
},
{
"status": "affected",
"version": "\u003e= 0.53.2.3, \u003c 0.53.9.5"
},
{
"status": "affected",
"version": "\u003e= 1.53.2.3, \u003c 1.53.9.5"
},
{
"status": "affected",
"version": "\u003e= 0.54.0.0, \u003c 0.54.1.5"
},
{
"status": "affected",
"version": "\u003e= 1.54.0.0, \u003c 1.54.1.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Metabase is an open source Business Intelligence and Embedded Analytics tool. When admins change Snowflake connection details in Metabase (either updating a password or changing password to private key or vice versa), Metabase would not always purge older Snowflake connection details from the application database. In order to remove older and stale connection details, Metabase would try one connection method at a time and purge all the other connection methods from the application database. When Metabase found a connection that worked, it would log (log/infof \"Successfully connected, migrating to: %s\" (pr-str test-details)) which would then print the username and password to the logger. This is fixed in 52.17.1, 53.9.5 and 54.1.5 in both the OSS and enterprise editions. Versions 51 and lower are not impacted."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 1.8,
"baseSeverity": "LOW",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532: Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-10T14:40:53.861Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/metabase/metabase/security/advisories/GHSA-832j-56xw-5p7f",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/metabase/metabase/security/advisories/GHSA-832j-56xw-5p7f"
}
],
"source": {
"advisory": "GHSA-832j-56xw-5p7f",
"discovery": "UNKNOWN"
},
"title": "Snowflake credentials logged by the Metabase backend"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-32382",
"datePublished": "2025-04-10T14:40:53.861Z",
"dateReserved": "2025-04-06T19:46:02.462Z",
"dateUpdated": "2025-04-10T15:23:19.566Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-30371 (GCVE-0-2025-30371)
Vulnerability from nvd – Published: 2025-03-28 14:47 – Updated: 2025-03-28 15:42
VLAI
EPSS
VEX
Title
Metabase vulnerable to circumvention of local link access protection in GeoJson endpoint
Summary
Metabase is a business intelligence and embedded analytics tool. Versions prior to v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8 are vulnerable to circumvention of local link access protection in GeoJson endpoint. Self hosted Metabase instances that are using the GeoJson feature could be potentially impacted if their Metabase is colocated with other unsecured resources. This is fixed in v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8. Migrating to Metabase Cloud or redeploying Metabase in a dedicated subnet with strict outbound port controls is an available workaround.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-03-28 15:42 UTC
CWE
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/metabase/metabase/security/adv… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-30371",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-28T15:42:00.655805Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-28T15:42:10.181Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "metabase",
"vendor": "metabase",
"versions": [
{
"status": "affected",
"version": "\u003c 0.52.16.4"
},
{
"status": "affected",
"version": "\u003c 1.52.16.4"
},
{
"status": "affected",
"version": "\u003c 0.53.8"
},
{
"status": "affected",
"version": "\u003c 1.53.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Metabase is a business intelligence and embedded analytics tool. Versions prior to v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8 are vulnerable to circumvention of local link access protection in GeoJson endpoint. Self hosted Metabase instances that are using the GeoJson feature could be potentially impacted if their Metabase is colocated with other unsecured resources. This is fixed in v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8. Migrating to Metabase Cloud or redeploying Metabase in a dedicated subnet with strict outbound port controls is an available workaround."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-28T14:47:36.718Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/metabase/metabase/security/advisories/GHSA-8xf9-9jc8-qp98",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/metabase/metabase/security/advisories/GHSA-8xf9-9jc8-qp98"
}
],
"source": {
"advisory": "GHSA-8xf9-9jc8-qp98",
"discovery": "UNKNOWN"
},
"title": "Metabase vulnerable to circumvention of local link access protection in GeoJson endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-30371",
"datePublished": "2025-03-28T14:47:36.718Z",
"dateReserved": "2025-03-21T14:12:06.272Z",
"dateUpdated": "2025-03-28T15:42:10.181Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-86116 (GCVE-0-2026-86116)
Vulnerability from cvelistv5 – Published: 2026-09-05 09:59 – Updated: 2026-09-08 17:26
VLAI
EPSS
VEX
Title
Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API
Summary
Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business glossary data without proper authorization.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 17:26 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/geo-chen/oss/blob/main/metabase.md | technical-description |
| https://github.com/metabase/metabase/blob/v0.62.1… | technical-description |
| https://github.com/metabase/metabase/commit/0a058… | patch |
| https://github.com/metabase/metabase/releases/tag… | release-notes |
| https://github.com/metabase/metabase | product |
| https://www.vulncheck.com/advisories/metabase-bef… | third-party-advisory |
Impacted products
Date Public
2026-09-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86116",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T17:26:29.950481Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T17:26:40.648Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/metabase/metabase",
"product": "metabase",
"repo": "https://github.com/metabase/metabase",
"vendor": "metabase",
"versions": [
{
"lessThan": "0.63.1",
"status": "affected",
"version": "0.57.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.63.1",
"versionStartIncluding": "0.57.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "George Chen"
}
],
"datePublic": "2026-09-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business glossary data without proper authorization."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-05T09:59:06.683Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher write-up",
"tags": [
"technical-description"
],
"url": "https://github.com/geo-chen/oss/blob/main/metabase.md"
},
{
"name": "Glossary POST/PUT/DELETE with no authorization check",
"tags": [
"technical-description"
],
"url": "https://github.com/metabase/metabase/blob/v0.62.1/src/metabase/glossary/api.clj"
},
{
"name": "Restrict glossary permissions (#76275)",
"tags": [
"patch"
],
"url": "https://github.com/metabase/metabase/commit/0a0589299cfd"
},
{
"name": "metabase v0.63.1 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/metabase/metabase/releases/tag/v0.63.1"
},
{
"tags": [
"product"
],
"url": "https://github.com/metabase/metabase"
},
{
"name": "VulnCheck Advisory: Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/metabase-before-0.63.1-missing-function-level-authorization-on-the-glossary-management-api"
}
],
"title": "Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86116",
"datePublished": "2026-09-05T09:59:06.683Z",
"dateReserved": "2026-09-05T01:59:20.944Z",
"dateUpdated": "2026-09-08T17:26:40.648Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72900 (GCVE-0-2026-72900)
Vulnerability from cvelistv5 – Published: 2026-08-10 17:56 – Updated: 2026-08-10 20:04
VLAI
EPSS
VEX
Title
Metabase information exposure
Summary
Metabase allows an authenticated, low-privileged attacker to read the entire Metabase application database.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · cisa-cg (v2.0.3)
Decision recorded 2026-08-10 17:20 UTC
CWE
- CWE-862 - Missing Authorization
References
3 references
| URL | Tags |
|---|---|
| https://github.com/metabase/metabase/security/adv… | vendor-advisory |
| https://www.cve.org/CVERecord?id=CVE-2026-72900 | vdb-entry |
| https://raw.githubusercontent.com/cisagov/CSAF/de… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Metabase | Metabase |
Affected:
x.58.0 , < x.58.24
(custom)
Unaffected: x.58.24 Affected: x.59.0 , < x.59.21 (custom) Unaffected: x.59.21 Affected: x.60.0 , < x.60.17 (custom) Unaffected: x.60.17 Affected: x.61.0 , < x.61.11 (custom) Unaffected: x.61.11 Affected: x.62.0 , < x.62.9 (custom) Unaffected: x.62.9 Affected: x.63.0 , < x.63.5 (custom) Unaffected: x.63.5 |
Date Public
2026-08-06 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72900",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T20:04:25.578746Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T20:04:45.028Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Metabase",
"vendor": "Metabase",
"versions": [
{
"lessThan": "x.58.24",
"status": "affected",
"version": "x.58.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "x.58.24"
},
{
"lessThan": "x.59.21",
"status": "affected",
"version": "x.59.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "x.59.21"
},
{
"lessThan": "x.60.17",
"status": "affected",
"version": "x.60.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "x.60.17"
},
{
"lessThan": "x.61.11",
"status": "affected",
"version": "x.61.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "x.61.11"
},
{
"lessThan": "x.62.9",
"status": "affected",
"version": "x.62.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "x.62.9"
},
{
"lessThan": "x.63.5",
"status": "affected",
"version": "x.63.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "x.63.5"
}
]
}
],
"datePublic": "2026-08-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Metabase allows an authenticated, low-privileged attacker to read the entire Metabase application database."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
},
{
"other": {
"content": {
"id": "CVE-2026-72900",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T17:20:03.619417Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T17:56:23.099Z",
"orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"shortName": "cisa-cg"
},
"references": [
{
"name": "url",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/metabase/metabase/security/advisories/GHSA-8hmm-hrhg-ppqp"
},
{
"name": "url",
"tags": [
"vdb-entry"
],
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72900"
},
{
"name": "url",
"tags": [
"third-party-advisory"
],
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-222-01.json"
}
],
"title": "Metabase information exposure"
}
},
"cveMetadata": {
"assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"assignerShortName": "cisa-cg",
"cveId": "CVE-2026-72900",
"datePublished": "2026-08-10T17:56:23.099Z",
"dateReserved": "2026-08-10T17:21:18.799Z",
"dateUpdated": "2026-08-10T20:04:45.028Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72899 (GCVE-0-2026-72899)
Vulnerability from cvelistv5 – Published: 2026-08-10 17:56 – Updated: 2026-08-11 03:55
VLAI
EPSS
VEX
Title
Metabase SQL injection via public card or dashboard
Summary
Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · cisa-cg (v2.0.3)
Decision recorded 2026-08-10 17:19 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
References
3 references
| URL | Tags |
|---|---|
| https://github.com/metabase/metabase/security/adv… | vendor-advisory |
| https://www.cve.org/CVERecord?id=CVE-2026-72899 | vdb-entry |
| https://raw.githubusercontent.com/cisagov/CSAF/de… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Metabase | Metabase |
Affected:
x.58.0 , < x.58.24
(custom)
Unaffected: x.58.24 Affected: x.59.0 , < x.59.21 (custom) Unaffected: x.59.21 Affected: x.60.0 , < x.60.17 (custom) Unaffected: x.60.17 Affected: x.61.0 , < x.61.11 (custom) Unaffected: x.61.11 Affected: x.62.0 , < x.62.9 (custom) Unaffected: x.62.9 Affected: x.63.0 , < x.63.5 (custom) Unaffected: x.63.5 |
Date Public
2026-08-06 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72899",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T03:55:38.382Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Metabase",
"vendor": "Metabase",
"versions": [
{
"lessThan": "x.58.24",
"status": "affected",
"version": "x.58.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "x.58.24"
},
{
"lessThan": "x.59.21",
"status": "affected",
"version": "x.59.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "x.59.21"
},
{
"lessThan": "x.60.17",
"status": "affected",
"version": "x.60.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "x.60.17"
},
{
"lessThan": "x.61.11",
"status": "affected",
"version": "x.61.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "x.61.11"
},
{
"lessThan": "x.62.9",
"status": "affected",
"version": "x.62.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "x.62.9"
},
{
"lessThan": "x.63.5",
"status": "affected",
"version": "x.63.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "x.63.5"
}
]
}
],
"datePublic": "2026-08-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
},
{
"other": {
"content": {
"id": "CVE-2026-72899",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T17:19:15.173020Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T17:56:09.950Z",
"orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"shortName": "cisa-cg"
},
"references": [
{
"name": "url",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/metabase/metabase/security/advisories/GHSA-r8h2-qpfx-mx59"
},
{
"name": "url",
"tags": [
"vdb-entry"
],
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72899"
},
{
"name": "url",
"tags": [
"third-party-advisory"
],
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-222-01.json"
}
],
"title": "Metabase SQL injection via public card or dashboard"
}
},
"cveMetadata": {
"assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"assignerShortName": "cisa-cg",
"cveId": "CVE-2026-72899",
"datePublished": "2026-08-10T17:56:09.950Z",
"dateReserved": "2026-08-10T17:21:11.759Z",
"dateUpdated": "2026-08-11T03:55:38.382Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72898 (GCVE-0-2026-72898)
Vulnerability from cvelistv5 – Published: 2026-08-10 17:55 – Updated: 2026-08-12 14:50Title
Metabase SQL injection via password reset endpoint
Summary
Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.
Severity
10 (Critical)
SSVC
Exploitation: active
Automatable: yes
Technical Impact: total
CISA Coordinator · cisa-cg (v2.0.3)
Decision recorded 2026-08-10 17:14 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
References
5 references
| URL | Tags |
|---|---|
| https://github.com/metabase/metabase/security/adv… | vendor-advisory |
| https://www.metabase.com/blog/security-update | vendor-advisory |
| https://www.cve.org/CVERecord?id=CVE-2026-72898 | vdb-entry |
| https://raw.githubusercontent.com/cisagov/CSAF/de… | third-party-advisory |
| https://www.cisa.gov/known-exploited-vulnerabilit… | government-resource |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Metabase | Metabase |
Affected:
x.58.0 , < x.58.24
(custom)
Unaffected: x.58.24 Affected: x.59.0 , < x.59.21 (custom) Unaffected: x.59.21 Affected: x.60.0 , < x.60.17 (custom) Unaffected: x.60.17 Affected: x.61.0 , < x.61.11 (custom) Unaffected: x.61.11 Affected: x.62.0 , < x.62.9 (custom) Unaffected: x.62.9 Affected: x.63.0 , < x.63.5 (custom) Unaffected: x.63.5 |
Date Public
2026-08-06 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72898",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T03:59:47.802633Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2026-08-11",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-72898"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T14:50:08.735Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-72898"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Metabase",
"vendor": "Metabase",
"versions": [
{
"lessThan": "x.58.24",
"status": "affected",
"version": "x.58.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "x.58.24"
},
{
"lessThan": "x.59.21",
"status": "affected",
"version": "x.59.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "x.59.21"
},
{
"lessThan": "x.60.17",
"status": "affected",
"version": "x.60.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "x.60.17"
},
{
"lessThan": "x.61.11",
"status": "affected",
"version": "x.61.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "x.61.11"
},
{
"lessThan": "x.62.9",
"status": "affected",
"version": "x.62.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "x.62.9"
},
{
"lessThan": "x.63.5",
"status": "affected",
"version": "x.63.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "x.63.5"
}
]
}
],
"datePublic": "2026-08-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the \u0027/reset_password\u0027 database endpoint and gain administrator access to the connected Metabase instance."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-72898",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T17:14:52.872411Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T17:55:54.841Z",
"orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"shortName": "cisa-cg"
},
"references": [
{
"name": "url",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf"
},
{
"name": "url",
"tags": [
"vendor-advisory"
],
"url": "https://www.metabase.com/blog/security-update"
},
{
"name": "url",
"tags": [
"vdb-entry"
],
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72898"
},
{
"name": "url",
"tags": [
"third-party-advisory"
],
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-222-01.json"
}
],
"title": "Metabase SQL injection via password reset endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"assignerShortName": "cisa-cg",
"cveId": "CVE-2026-72898",
"datePublished": "2026-08-10T17:55:54.841Z",
"dateReserved": "2026-08-10T17:20:39.650Z",
"dateUpdated": "2026-08-12T14:50:08.735Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-50147 (GCVE-0-2026-50147)
Vulnerability from cvelistv5 – Published: 2026-07-15 15:21 – Updated: 2026-07-15 16:04
VLAI
EPSS
VEX
Title
Metabase: Arbitrary File Read via MySQL Connection Property Injection
Summary
Metabase is an open-source business intelligence and embedded analytics tool. From 1.57.0 until 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4, an attacker who can configure a Metabase database connection can read arbitrary files from the Metabase server's filesystem by adding unsafe JDBC parameters to a MySQL or MariaDB connection, causing the driver to read files from the Metabase host and expose the contents through queries against the connected database or through validation error messages. This issue is fixed in versions 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4.
Severity
7.6 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-15 16:03 UTC
CWE
- CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/metabase/metabase/security/adv… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-50147",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-15T16:03:56.744985Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T16:04:03.343Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "metabase",
"vendor": "metabase",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.57.0, \u003c 1.57.19.1"
},
{
"status": "affected",
"version": "\u003e= 1.58.0, \u003c 1.58.14.1"
},
{
"status": "affected",
"version": "\u003e= 1.59.0, \u003c 1.59.10"
},
{
"status": "affected",
"version": "\u003e= 1.60.0, \u003c 1.60.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Metabase is an open-source business intelligence and embedded analytics tool. From 1.57.0 until 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4, an attacker who can configure a Metabase database connection can read arbitrary files from the Metabase server\u0027s filesystem by adding unsafe JDBC parameters to a MySQL or MariaDB connection, causing the driver to read files from the Metabase host and expose the contents through queries against the connected database or through validation error messages. This issue is fixed in versions 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-88",
"description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T15:21:23.107Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/metabase/metabase/security/advisories/GHSA-mfpj-crjq-xrcp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/metabase/metabase/security/advisories/GHSA-mfpj-crjq-xrcp"
}
],
"source": {
"advisory": "GHSA-mfpj-crjq-xrcp",
"discovery": "UNKNOWN"
},
"title": "Metabase: Arbitrary File Read via MySQL Connection Property Injection"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-50147",
"datePublished": "2026-07-15T15:21:23.107Z",
"dateReserved": "2026-06-03T18:49:32.276Z",
"dateUpdated": "2026-07-15T16:04:03.343Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-50148 (GCVE-0-2026-50148)
Vulnerability from cvelistv5 – Published: 2026-07-15 15:18 – Updated: 2026-07-20 14:55
VLAI
EPSS
VEX
Title
Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write
Summary
Metabase is an open-source business intelligence and embedded analytics tool. From 1.54.0 until 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4, a Metabase user with permission to add or edit a database connection can achieve remote code execution on the Metabase server by configuring a Snowflake connection to an attacker-controlled server, because a flaw in the Snowflake JDBC driver can write arbitrary files anywhere on the Metabase host, including replacing one of Metabase's own database driver files that later executes inside the Metabase process. This issue is fixed in versions 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-20 14:54 UTC
CWE
- CWE-73 - External Control of File Name or Path
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/metabase/metabase/security/adv… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-50148",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-20T14:54:57.235870Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T14:55:07.812Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "metabase",
"vendor": "metabase",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.54.0, \u003c 1.54.24"
},
{
"status": "affected",
"version": "\u003e= 1.55.0, \u003c 1.55.24"
},
{
"status": "affected",
"version": "\u003e= 1.56.0, \u003c 1.56.25"
},
{
"status": "affected",
"version": "\u003e= 1.57.0, \u003c 1.57.19"
},
{
"status": "affected",
"version": "\u003e= 1.58.0, \u003c 1.58.14"
},
{
"status": "affected",
"version": "\u003e= 1.59.0, \u003c 1.59.10"
},
{
"status": "affected",
"version": "\u003e= 1.60.0, \u003c 1.60.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Metabase is an open-source business intelligence and embedded analytics tool. From 1.54.0 until 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4, a Metabase user with permission to add or edit a database connection can achieve remote code execution on the Metabase server by configuring a Snowflake connection to an attacker-controlled server, because a flaw in the Snowflake JDBC driver can write arbitrary files anywhere on the Metabase host, including replacing one of Metabase\u0027s own database driver files that later executes inside the Metabase process. This issue is fixed in versions 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "CWE-73: External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T15:18:04.142Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/metabase/metabase/security/advisories/GHSA-r6x2-rchx-q9g9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/metabase/metabase/security/advisories/GHSA-r6x2-rchx-q9g9"
}
],
"source": {
"advisory": "GHSA-r6x2-rchx-q9g9",
"discovery": "UNKNOWN"
},
"title": "Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-50148",
"datePublished": "2026-07-15T15:18:04.142Z",
"dateReserved": "2026-06-03T18:49:32.276Z",
"dateUpdated": "2026-07-20T14:55:07.812Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59826 (GCVE-0-2026-59826)
Vulnerability from cvelistv5 – Published: 2026-07-09 17:46 – Updated: 2026-07-10 03:55
VLAI
EPSS
VEX
Title
Metabase: Arbitrary Code Execution via Database Connection Detail Bypass
Summary
Metabase is an open-source business intelligence and embedded analytics tool. From 1.55.0 until 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2, Metabase did not validate unsafe H2 connection properties on one database-creation code path, allowing an authenticated administrator to register a crafted H2 database connection and execute arbitrary Java code on the Metabase server. This issue is fixed in versions 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-09 00:00 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/metabase/metabase/security/adv… | x_refsource_CONFIRM |
| https://github.com/metabase/metabase/commit/74032… | x_refsource_MISC |
| https://github.com/metabase/metabase/releases/tag… | x_refsource_MISC |
| https://github.com/metabase/metabase/releases/tag… | x_refsource_MISC |
| https://github.com/metabase/metabase/releases/tag… | x_refsource_MISC |
| https://github.com/metabase/metabase/releases/tag… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59826",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-09T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T03:55:49.067Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "metabase",
"vendor": "metabase",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.55.0, \u003c 1.58.15.1"
},
{
"status": "affected",
"version": "\u003e= 1.59.0, \u003c 1.59.12"
},
{
"status": "affected",
"version": "\u003e= 1.60.0, \u003c 1.60.6.3"
},
{
"status": "affected",
"version": "\u003e= 1.61.0, \u003c 1.61.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Metabase is an open-source business intelligence and embedded analytics tool. From 1.55.0 until 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2, Metabase did not validate unsafe H2 connection properties on one database-creation code path, allowing an authenticated administrator to register a crafted H2 database connection and execute arbitrary Java code on the Metabase server. This issue is fixed in versions 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T17:46:36.365Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/metabase/metabase/security/advisories/GHSA-8wx2-rxp2-4x35",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/metabase/metabase/security/advisories/GHSA-8wx2-rxp2-4x35"
},
{
"name": "https://github.com/metabase/metabase/commit/74032e5e0a5a70dc45a6a744d37b9ba24eee8d01",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/metabase/metabase/commit/74032e5e0a5a70dc45a6a744d37b9ba24eee8d01"
},
{
"name": "https://github.com/metabase/metabase/releases/tag/v0.58.15.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/metabase/metabase/releases/tag/v0.58.15.1"
},
{
"name": "https://github.com/metabase/metabase/releases/tag/v0.59.12",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/metabase/metabase/releases/tag/v0.59.12"
},
{
"name": "https://github.com/metabase/metabase/releases/tag/v0.60.6.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/metabase/metabase/releases/tag/v0.60.6.3"
},
{
"name": "https://github.com/metabase/metabase/releases/tag/v0.61.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/metabase/metabase/releases/tag/v0.61.2"
}
],
"source": {
"advisory": "GHSA-8wx2-rxp2-4x35",
"discovery": "UNKNOWN"
},
"title": "Metabase: Arbitrary Code Execution via Database Connection Detail Bypass"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-59826",
"datePublished": "2026-07-09T17:46:36.365Z",
"dateReserved": "2026-07-07T15:00:50.979Z",
"dateUpdated": "2026-07-10T03:55:49.067Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59827 (GCVE-0-2026-59827)
Vulnerability from cvelistv5 – Published: 2026-07-09 17:43 – Updated: 2026-07-09 18:24
VLAI
EPSS
VEX
Title
Metabase: Unsafe Deserialization of H2 Query Results
Summary
Metabase is an open-source business intelligence and embedded analytics tool. Prior to 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4, Metabase instances with an H2 database connection, including the default sample database, deserialize arbitrary Java objects returned in H2 native query result columns of type OTHER without validation, allowing an authenticated user who can run native H2 queries to execute code on the Metabase server. This issue is fixed in versions 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-09 18:21 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/metabase/metabase/security/adv… | x_refsource_CONFIRM |
| https://github.com/metabase/metabase/commit/00f42… | x_refsource_MISC |
| https://github.com/metabase/metabase/releases/tag… | x_refsource_MISC |
| https://github.com/metabase/metabase/releases/tag… | x_refsource_MISC |
| https://github.com/metabase/metabase/releases/tag… | x_refsource_MISC |
| https://github.com/metabase/metabase/releases/tag… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59827",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-09T18:21:29.850266Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T18:24:48.433Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "metabase",
"vendor": "metabase",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.58.0, \u003c 1.58.15"
},
{
"status": "affected",
"version": "\u003e= 1.59.0, \u003c 1.59.12"
},
{
"status": "affected",
"version": "\u003e= 1.60.0, \u003c 1.60.6.3"
},
{
"status": "affected",
"version": "\u003e= 1.61.0, \u003c 1.61.1.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Metabase is an open-source business intelligence and embedded analytics tool. Prior to 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4, Metabase instances with an H2 database connection, including the default sample database, deserialize arbitrary Java objects returned in H2 native query result columns of type OTHER without validation, allowing an authenticated user who can run native H2 queries to execute code on the Metabase server. This issue is fixed in versions 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502: Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T17:43:57.546Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/metabase/metabase/security/advisories/GHSA-w95f-x9v9-wv36",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/metabase/metabase/security/advisories/GHSA-w95f-x9v9-wv36"
},
{
"name": "https://github.com/metabase/metabase/commit/00f42511fe3bc4385652a2e96862ee6fd7d42cf8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/metabase/metabase/commit/00f42511fe3bc4385652a2e96862ee6fd7d42cf8"
},
{
"name": "https://github.com/metabase/metabase/releases/tag/v0.58.15",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/metabase/metabase/releases/tag/v0.58.15"
},
{
"name": "https://github.com/metabase/metabase/releases/tag/v0.59.12",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/metabase/metabase/releases/tag/v0.59.12"
},
{
"name": "https://github.com/metabase/metabase/releases/tag/v0.60.6.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/metabase/metabase/releases/tag/v0.60.6.3"
},
{
"name": "https://github.com/metabase/metabase/releases/tag/v0.61.1.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/metabase/metabase/releases/tag/v0.61.1.4"
}
],
"source": {
"advisory": "GHSA-w95f-x9v9-wv36",
"discovery": "UNKNOWN"
},
"title": "Metabase: Unsafe Deserialization of H2 Query Results"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-59827",
"datePublished": "2026-07-09T17:43:57.546Z",
"dateReserved": "2026-07-07T15:00:50.979Z",
"dateUpdated": "2026-07-09T18:24:48.433Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33725 (GCVE-0-2026-33725)
Vulnerability from cvelistv5 – Published: 2026-03-27 00:19 – Updated: 2026-03-28 03:55
VLAI
EPSS
VEX
Title
Metabase vulnerable to RCE and Arbitrary File Read via H2 JDBC INIT Injection in EE Serialization Import
Summary
Metabase is an open source business intelligence and embedded analytics tool. In Metabase Enterprise prior to versions 1.54.22, 1.55.22, 1.56.22, 1.57.16, 1.58.10, and 1.59.4, authenticated admins on Metabase Enterprise Edition can achieve Remote Code Execution (RCE) and Arbitrary File Read via the `POST /api/ee/serialization/import` endpoint. A crafted serialization archive injects an `INIT` property into the H2 JDBC spec, which can execute arbitrary SQL during a database sync. We confirmed this was possible on Metabase Cloud. This only affects Metabase Enterprise. Metabase OSS lacks the affected codepaths. All versions of Metabase Enterprise that have serialization, which dates back to at least version 1.47, are affected. Metabase Enterprise versions 1.54.22, 1.55.22, 1.56.22, 1.57.16, 1.58.10, and 1.59.4 patch the issue. As a workaround, disable the serialization import endpoint in their Metabase instance to prevent access to the vulnerable codepaths.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-27 00:00 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/metabase/metabase/security/adv… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33725",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-27T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-28T03:55:51.956Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "metabase",
"vendor": "metabase",
"versions": [
{
"status": "affected",
"version": "\u003c 1.54.22"
},
{
"status": "affected",
"version": "\u003e= 1.55.0, \u003c 1.55.22"
},
{
"status": "affected",
"version": "\u003e= 1.56.0, \u003c 1.56.22"
},
{
"status": "affected",
"version": "\u003e= 1.57.0, \u003c 1.57.16"
},
{
"status": "affected",
"version": "\u003e= 1.58.0, \u003c 1.58.10"
},
{
"status": "affected",
"version": "\u003e= 1.59.0, \u003c 1.59.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Metabase is an open source business intelligence and embedded analytics tool. In Metabase Enterprise prior to versions 1.54.22, 1.55.22, 1.56.22, 1.57.16, 1.58.10, and 1.59.4, authenticated admins on Metabase Enterprise Edition can achieve Remote Code Execution (RCE) and Arbitrary File Read via the `POST /api/ee/serialization/import` endpoint. A crafted serialization archive injects an `INIT` property into the H2 JDBC spec, which can execute arbitrary SQL during a database sync. We confirmed this was possible on Metabase Cloud. This only affects Metabase Enterprise. Metabase OSS lacks the affected codepaths. All versions of Metabase Enterprise that have serialization, which dates back to at least version 1.47, are affected. Metabase Enterprise versions 1.54.22, 1.55.22, 1.56.22, 1.57.16, 1.58.10, and 1.59.4 patch the issue. As a workaround, disable the serialization import endpoint in their Metabase instance to prevent access to the vulnerable codepaths."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502: Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-27T00:19:39.397Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/metabase/metabase/security/advisories/GHSA-fppj-vcm3-w229",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/metabase/metabase/security/advisories/GHSA-fppj-vcm3-w229"
}
],
"source": {
"advisory": "GHSA-fppj-vcm3-w229",
"discovery": "UNKNOWN"
},
"title": "Metabase vulnerable to RCE and Arbitrary File Read via H2 JDBC INIT Injection in EE Serialization Import"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33725",
"datePublished": "2026-03-27T00:19:39.397Z",
"dateReserved": "2026-03-23T17:34:57.559Z",
"dateUpdated": "2026-03-28T03:55:51.956Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-27464 (GCVE-0-2026-27464)
Vulnerability from cvelistv5 – Published: 2026-02-21 07:57 – Updated: 2026-02-24 18:51
VLAI
EPSS
VEX
Title
Metabase: Server-Side Template Injection via Notifications Endpoint Leads to RCE
Summary
Metabase is an open-source data analytics platform. In versions prior to 0.57.13 and versions 0.58.x through 0.58.6, authenticated users are able to retrieve sensitive information from a Metabase instance, including database access credentials. During testing, it was confirmed that a low-privileged user can extract sensitive information including database credentials, into the email body via template evaluation. This issue has been fixed in versions 0.57.13 and 0.58.7. To workaround this issue, users can disable notifications in their Metabase instance to disallow access to the vulnerable endpoints.
Severity
7.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-24 18:50 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/metabase/metabase/security/adv… | x_refsource_CONFIRM |
| https://github.com/metabase/metabase/releases/tag… | x_refsource_MISC |
| https://github.com/metabase/metabase/releases/tag… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-27464",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-24T18:50:49.320406Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T18:51:05.408Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "metabase",
"vendor": "metabase",
"versions": [
{
"status": "affected",
"version": "\u003c 0.57.13"
},
{
"status": "affected",
"version": "\u003e= 0.58.x, \u003c 0.58.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Metabase is an open-source data analytics platform. In versions prior to 0.57.13 and versions 0.58.x through 0.58.6, authenticated users are able to retrieve sensitive information from a Metabase instance, including database access credentials. During testing, it was confirmed that a low-privileged user can extract sensitive information including database credentials, into the email body via template evaluation. This issue has been fixed in versions 0.57.13 and 0.58.7. To workaround this issue, users can disable notifications in their Metabase instance to disallow access to the vulnerable endpoints."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-21T07:57:50.957Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/metabase/metabase/security/advisories/GHSA-vcj8-rcm8-gfj9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/metabase/metabase/security/advisories/GHSA-vcj8-rcm8-gfj9"
},
{
"name": "https://github.com/metabase/metabase/releases/tag/v0.57.13",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/metabase/metabase/releases/tag/v0.57.13"
},
{
"name": "https://github.com/metabase/metabase/releases/tag/v0.58.7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/metabase/metabase/releases/tag/v0.58.7"
}
],
"source": {
"advisory": "GHSA-vcj8-rcm8-gfj9",
"discovery": "UNKNOWN"
},
"title": "Metabase: Server-Side Template Injection via Notifications Endpoint Leads to RCE"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-27464",
"datePublished": "2026-02-21T07:57:50.957Z",
"dateReserved": "2026-02-19T17:25:31.101Z",
"dateUpdated": "2026-02-24T18:51:05.408Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-22805 (GCVE-0-2026-22805)
Vulnerability from cvelistv5 – Published: 2026-01-12 22:36 – Updated: 2026-01-13 19:07
VLAI
EPSS
VEX
Title
Metabase channel test endpoint can reach internal local addresses
Summary
Metabase is an open-source data analytics platform. Prior to 55.13, 56.3, and 57.1, self-hosted Metabase instances that allow users to create subscriptions could be potentially impacted if their Metabase is colocated with other unsecured resources. This vulnerability is fixed in 55.13, 56.3, and 57.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-13 14:13 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/metabase/metabase/security/adv… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22805",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-13T14:13:44.384619Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-13T19:07:47.948Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "metabase",
"vendor": "metabase",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.57.0-beta, \u003c 57.1"
},
{
"status": "affected",
"version": "\u003e= 0.56.0-beta, \u003c 56.3"
},
{
"status": "affected",
"version": "\u003c 55.13"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Metabase is an open-source data analytics platform. Prior to 55.13, 56.3, and 57.1, self-hosted Metabase instances that allow users to create subscriptions could be potentially impacted if their Metabase is colocated with other unsecured resources. This vulnerability is fixed in 55.13, 56.3, and 57.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-12T22:36:35.272Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/metabase/metabase/security/advisories/GHSA-2wgg-7r2p-cmqx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/metabase/metabase/security/advisories/GHSA-2wgg-7r2p-cmqx"
}
],
"source": {
"advisory": "GHSA-2wgg-7r2p-cmqx",
"discovery": "UNKNOWN"
},
"title": "Metabase channel test endpoint can reach internal local addresses"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-22805",
"datePublished": "2026-01-12T22:36:35.272Z",
"dateReserved": "2026-01-09T22:50:10.287Z",
"dateUpdated": "2026-01-13T19:07:47.948Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-5895 (GCVE-0-2025-5895)
Vulnerability from cvelistv5 – Published: 2025-06-09 20:00 – Updated: 2025-06-10 15:30
VLAI
EPSS
VEX
Title
Metabase dom.js parseDataUri redos
Summary
A vulnerability was found in Metabase 54.10. It has been classified as problematic. This affects the function parseDataUri of the file frontend/src/metabase/lib/dom.js. The manipulation leads to inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The patch is named 4454ebbdc7719016bf80ca0f34859ce5cee9f6b0. It is recommended to apply a patch to fix this issue.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-10 14:23 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.311667 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.311667 | signaturepermissions-required |
| https://vuldb.com/?submit.585795 | third-party-advisory |
| https://github.com/metabase/metabase/pull/57011 | issue-tracking |
| https://github.com/metabase/metabase/pull/57011#p… | exploitissue-tracking |
| https://github.com/metabase/metabase/commit/4454e… | patch |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-5895",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-10T14:23:31.679790Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-10T15:30:32.919Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/metabase/metabase/pull/57011"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Metabase",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "54.10"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "mmmsssttt (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Metabase 54.10. It has been classified as problematic. This affects the function parseDataUri of the file frontend/src/metabase/lib/dom.js. The manipulation leads to inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The patch is named 4454ebbdc7719016bf80ca0f34859ce5cee9f6b0. It is recommended to apply a patch to fix this issue."
},
{
"lang": "de",
"value": "Es wurde eine Schwachstelle in Metabase 54.10 ausgemacht. Sie wurde als problematisch eingestuft. Es geht dabei um die Funktion parseDataUri der Datei frontend/src/metabase/lib/dom.js. Durch Manipulation mit unbekannten Daten kann eine inefficient regular expression complexity-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung. Der Patch wird als 4454ebbdc7719016bf80ca0f34859ce5cee9f6b0 bezeichnet. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "Inefficient Regular Expression Complexity",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-09T20:00:19.261Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-311667 | Metabase dom.js parseDataUri redos",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.311667"
},
{
"name": "VDB-311667 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.311667"
},
{
"name": "Submit #585795 | metabase @metabase 54.10 Inefficient Regular Expression Complexity",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.585795"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/metabase/metabase/pull/57011"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/metabase/metabase/pull/57011#pullrequestreview-2792664135"
},
{
"tags": [
"patch"
],
"url": "https://github.com/metabase/metabase/commit/4454ebbdc7719016bf80ca0f34859ce5cee9f6b0"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-06-09T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-06-09T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-06-09T08:52:20.000Z",
"value": "VulDB entry last update"
}
],
"title": "Metabase dom.js parseDataUri redos"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-5895",
"datePublished": "2025-06-09T20:00:19.261Z",
"dateReserved": "2025-06-09T06:47:00.425Z",
"dateUpdated": "2025-06-10T15:30:32.919Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-32382 (GCVE-0-2025-32382)
Vulnerability from cvelistv5 – Published: 2025-04-10 14:40 – Updated: 2025-04-10 15:23
VLAI
EPSS
VEX
Title
Snowflake credentials logged by the Metabase backend
Summary
Metabase is an open source Business Intelligence and Embedded Analytics tool. When admins change Snowflake connection details in Metabase (either updating a password or changing password to private key or vice versa), Metabase would not always purge older Snowflake connection details from the application database. In order to remove older and stale connection details, Metabase would try one connection method at a time and purge all the other connection methods from the application database. When Metabase found a connection that worked, it would log (log/infof "Successfully connected, migrating to: %s" (pr-str test-details)) which would then print the username and password to the logger. This is fixed in 52.17.1, 53.9.5 and 54.1.5 in both the OSS and enterprise editions. Versions 51 and lower are not impacted.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-10 15:23 UTC
CWE
- CWE-532 - Insertion of Sensitive Information into Log File
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/metabase/metabase/security/adv… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-32382",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-10T15:23:05.467005Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-10T15:23:19.566Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "metabase",
"vendor": "metabase",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.52.12, \u003c 0.52.17.1"
},
{
"status": "affected",
"version": "\u003e= 1.52.12, \u003c 1.52.17.1"
},
{
"status": "affected",
"version": "\u003e= 0.53.2.3, \u003c 0.53.9.5"
},
{
"status": "affected",
"version": "\u003e= 1.53.2.3, \u003c 1.53.9.5"
},
{
"status": "affected",
"version": "\u003e= 0.54.0.0, \u003c 0.54.1.5"
},
{
"status": "affected",
"version": "\u003e= 1.54.0.0, \u003c 1.54.1.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Metabase is an open source Business Intelligence and Embedded Analytics tool. When admins change Snowflake connection details in Metabase (either updating a password or changing password to private key or vice versa), Metabase would not always purge older Snowflake connection details from the application database. In order to remove older and stale connection details, Metabase would try one connection method at a time and purge all the other connection methods from the application database. When Metabase found a connection that worked, it would log (log/infof \"Successfully connected, migrating to: %s\" (pr-str test-details)) which would then print the username and password to the logger. This is fixed in 52.17.1, 53.9.5 and 54.1.5 in both the OSS and enterprise editions. Versions 51 and lower are not impacted."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 1.8,
"baseSeverity": "LOW",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532: Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-10T14:40:53.861Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/metabase/metabase/security/advisories/GHSA-832j-56xw-5p7f",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/metabase/metabase/security/advisories/GHSA-832j-56xw-5p7f"
}
],
"source": {
"advisory": "GHSA-832j-56xw-5p7f",
"discovery": "UNKNOWN"
},
"title": "Snowflake credentials logged by the Metabase backend"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-32382",
"datePublished": "2025-04-10T14:40:53.861Z",
"dateReserved": "2025-04-06T19:46:02.462Z",
"dateUpdated": "2025-04-10T15:23:19.566Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-30371 (GCVE-0-2025-30371)
Vulnerability from cvelistv5 – Published: 2025-03-28 14:47 – Updated: 2025-03-28 15:42
VLAI
EPSS
VEX
Title
Metabase vulnerable to circumvention of local link access protection in GeoJson endpoint
Summary
Metabase is a business intelligence and embedded analytics tool. Versions prior to v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8 are vulnerable to circumvention of local link access protection in GeoJson endpoint. Self hosted Metabase instances that are using the GeoJson feature could be potentially impacted if their Metabase is colocated with other unsecured resources. This is fixed in v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8. Migrating to Metabase Cloud or redeploying Metabase in a dedicated subnet with strict outbound port controls is an available workaround.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-03-28 15:42 UTC
CWE
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/metabase/metabase/security/adv… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-30371",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-28T15:42:00.655805Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-28T15:42:10.181Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "metabase",
"vendor": "metabase",
"versions": [
{
"status": "affected",
"version": "\u003c 0.52.16.4"
},
{
"status": "affected",
"version": "\u003c 1.52.16.4"
},
{
"status": "affected",
"version": "\u003c 0.53.8"
},
{
"status": "affected",
"version": "\u003c 1.53.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Metabase is a business intelligence and embedded analytics tool. Versions prior to v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8 are vulnerable to circumvention of local link access protection in GeoJson endpoint. Self hosted Metabase instances that are using the GeoJson feature could be potentially impacted if their Metabase is colocated with other unsecured resources. This is fixed in v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8. Migrating to Metabase Cloud or redeploying Metabase in a dedicated subnet with strict outbound port controls is an available workaround."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-28T14:47:36.718Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/metabase/metabase/security/advisories/GHSA-8xf9-9jc8-qp98",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/metabase/metabase/security/advisories/GHSA-8xf9-9jc8-qp98"
}
],
"source": {
"advisory": "GHSA-8xf9-9jc8-qp98",
"discovery": "UNKNOWN"
},
"title": "Metabase vulnerable to circumvention of local link access protection in GeoJson endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-30371",
"datePublished": "2025-03-28T14:47:36.718Z",
"dateReserved": "2025-03-21T14:12:06.272Z",
"dateUpdated": "2025-03-28T15:42:10.181Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CERTFR-2026-AVI-1075
Vulnerability from certfr_avis - Published: 2026-08-24 - Updated: 2026-08-24
De multiples vulnérabilités ont été découvertes dans Metabase. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une injection SQL (SQLi) et un problème de sécurité non spécifié par l'éditeur.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Metabase | Metabase | metabase versions antérieures à x.58.28 | ||
| Metabase | Metabase | metabase versions x.61.x antérieures à x.61.15 | ||
| Metabase | Metabase | metabase versions x.59.x antérieures à x.59.25 | ||
| Metabase | Metabase | metabase versions antérieures à x.63.10 | ||
| Metabase | Metabase | metabase versions x.60.x antérieures à x.60.21 | ||
| Metabase | Metabase | metabase versions x.62.x antérieures à x.62.13 |
References
| Title | Publication Time | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "metabase versions ant\u00e9rieures \u00e0 x.58.28",
"product": {
"name": "Metabase",
"vendor": {
"name": "Metabase",
"scada": false
}
}
},
{
"description": "metabase versions x.61.x ant\u00e9rieures \u00e0 x.61.15",
"product": {
"name": "Metabase",
"vendor": {
"name": "Metabase",
"scada": false
}
}
},
{
"description": "metabase versions x.59.x ant\u00e9rieures \u00e0 x.59.25",
"product": {
"name": "Metabase",
"vendor": {
"name": "Metabase",
"scada": false
}
}
},
{
"description": "metabase versions ant\u00e9rieures \u00e0 x.63.10",
"product": {
"name": "Metabase",
"vendor": {
"name": "Metabase",
"scada": false
}
}
},
{
"description": "metabase versions x.60.x ant\u00e9rieures \u00e0 x.60.21",
"product": {
"name": "Metabase",
"vendor": {
"name": "Metabase",
"scada": false
}
}
},
{
"description": "metabase versions x.62.x ant\u00e9rieures \u00e0 x.62.13",
"product": {
"name": "Metabase",
"vendor": {
"name": "Metabase",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-72900",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72900"
},
{
"name": "CVE-2026-72898",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72898"
},
{
"name": "CVE-2026-72899",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72899"
}
],
"initial_release_date": "2026-08-24T00:00:00",
"last_revision_date": "2026-08-24T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1075",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-08-24T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection SQL (SQLi)"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Metabase. Elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es, une injection SQL (SQLi) et un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Metabase",
"vendor_advisories": [
{
"published_at": "2026-08-06",
"title": "Bulletin de s\u00e9curit\u00e9 Metabase GHSA-vwf4-m7j8-wcjf",
"url": "https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf"
},
{
"published_at": "2026-08-06",
"title": "Bulletin de s\u00e9curit\u00e9 Metabase GHSA-r8h2-qpfx-mx59",
"url": "https://github.com/metabase/metabase/security/advisories/GHSA-r8h2-qpfx-mx59"
},
{
"published_at": "2026-08-11",
"title": "Bulletin de s\u00e9curit\u00e9 Metabase GHSA-r495-55cx-fjh7",
"url": "https://github.com/metabase/metabase/security/advisories/GHSA-r495-55cx-fjh7"
},
{
"published_at": "2026-08-06",
"title": "Bulletin de s\u00e9curit\u00e9 Metabase GHSA-8hmm-hrhg-ppqp",
"url": "https://github.com/metabase/metabase/security/advisories/GHSA-8hmm-hrhg-ppqp"
}
]
}