Read the docs

Metabase

Records34All Threatist records
Exploited (KEV)2In CISA KEV
CVSS critical10CVSS 9.0–10.0
CVSS high9CVSS 7.0–8.9

Exploited now

Metabase records in CISA KEV
TI-2026-51115 Metabase SQL Injection Vulnerability Priority CRITICAL 100KEV 2026-08-11TI-2021-18109 Metabase GeoJSON API Local File Inclusion Vulnerability Priority CRITICAL 100KEV 2024-11-12

Components

Products in the NVD configurations · select one to filter the records
Metabase 26 records CRITICAL

Records

34 records

TI-2026-51115 CVE-2026-72898

Metabase SQL injection via password reset endpoint

Priority CRITICAL 100KEV

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.98809 Published 2026-08-10 Fixed in x.58.24, x.59.21 +4 CWE-89
TI-2026-62552 CVE-2026-92813 · GHSA-vhcq-xc7j-xfj8

Metabase through 0.63.18 SSRF via GeoJSON URL validation bypass

Priority MEDIUM 64

Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing unauthenticated attackers to reach loopback services.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00474 Published 2026-09-16 No fix listed CWE-918
TI-2022-08664 CVE-2022-24853

File system exposure in Metabase

Priority MEDIUM 60

Metabase is an open source business intelligence and analytics application.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.02524 Published 2022-04-14 Fixed in 1.40.7, 0.40.7 +4 CWE-200
TI-2025-05321 CVE-2025-5895 · GHSA-94cm-j3mf-q873

Metabase dom.js parseDataUri redos

Priority MEDIUM 57

A vulnerability was found in Metabase 54.10.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0067 Published 2025-06-09 No fix listed CWE-1333
TI-2026-51116 CVE-2026-72899

Metabase SQL injection via public card or dashboard

Priority MEDIUM 50

Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00787 Published 2026-08-10 Fixed in x.58.24, x.59.21 +4 CWE-89
TI-2023-15956 CVE-2023-32680

Missing SQL permissions check in metabase

Priority MEDIUM 42

Metabase is an open source business analytics engine.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00598 Published 2023-05-18 Fixed in 0.44.7, 1.44.7 +4 CWE-306
TI-2022-08666 CVE-2022-24855

XSS vulnerability in Metabase

Priority MEDIUM 41

Metabase is an open source business intelligence and analytics application.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00712 Published 2022-04-14 Fixed in 1.40.8, 0.40.8 +4 CWE-79
TI-2026-51117 CVE-2026-72900

Metabase information exposure

Priority LOW 31

Metabase allows an authenticated, low-privileged attacker to read the entire Metabase application database.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00402 Published 2026-08-10 Fixed in x.58.24, x.59.21 +4 CWE-862
TI-2022-21510 CVE-2022-43776 · GHSA-mppc-g8x5-rq8c

Server-side request forgery in Metabase

Priority LOW 30

The url parameter of the /api/geojson endpoint in Metabase versions <44.5 can be used to perform Server Side Request Forgery attacks.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00798 Published 2022-10-26 Fixed in 44.5 CWE-918
Load more
Open these records in search →