Metabase

Records34All Threatist records

Exploited (KEV)2In CISA KEV

CVSS critical10CVSS 9.0–10.0

CVSS high9CVSS 7.0–8.9

Exploited now

Metabase records in CISA KEV

TI-2026-51115 Metabase SQL Injection Vulnerability CRITICAL 100KEV 2026-08-11 TI-2021-18109 Metabase GeoJSON API Local File Inclusion Vulnerability CRITICAL 100KEV 2024-11-12

Components

Products in the NVD configurations · select one to filter the records

Metabase 26 records CRITICAL

Records

26 records in Metabase · all components

TI-2026-51115 CVE-2026-72898

Metabase SQL injection via password reset endpoint

CRITICAL 100KEV

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.98809 Published 2026-08-10 Fixed in x.58.24, x.59.21 +4 CWE-89

TI-2021-18109 CVE-2021-41277

GeoJSON URL validation can expose server files and environment variables to unauthorized users

CRITICAL 100KEV

Metabase is an open source data analytics platform.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.97178 Published 2021-11-17 Fixed in 0.40.5, 1.40.5 CWE-200

TI-2023-20003 CVE-2023-38646 · GHSA-jg32-8h6w-x7vg

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow…

CRITICAL 87

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99478 Published 2023-07-21 No fix listed

TI-2022-08664 CVE-2022-24853

File system exposure in Metabase

MEDIUM 60

Metabase is an open source business intelligence and analytics application.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.02524 Published 2022-04-14 Fixed in 1.40.7, 0.40.7 +4 CWE-200

TI-2025-05321 CVE-2025-5895 · GHSA-94cm-j3mf-q873

Metabase dom.js parseDataUri redos

MEDIUM 57

A vulnerability was found in Metabase 54.10.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0067 Published 2025-06-09 No fix listed CWE-1333

TI-2023-19078 CVE-2023-37470

Metabase vulnerable to remote code execution via POST /api/setup/validate API endpoint

MEDIUM 52

Metabase is an open-source business intelligence and analytics platform.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01349 Published 2023-08-04 Fixed in 0.43.7.3, 0.44.7.3 +6 CWE-94

TI-2026-36917 CVE-2026-50148

Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write

MEDIUM 50

Metabase is an open-source business intelligence and embedded analytics tool.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00768 Published 2026-07-15 Fixed in 1.54.24, 1.55.24 +5 CWE-73

TI-2026-42643 CVE-2026-59827

Metabase: Unsafe Deserialization of H2 Query Results

MEDIUM 49

Metabase is an open-source business intelligence and embedded analytics tool.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.03788 Published 2026-07-09 Fixed in 1.58.15, 1.59.12 +2 CWE-502

TI-2026-42642 CVE-2026-59826

Metabase: Arbitrary Code Execution via Database Connection Detail Bypass

MEDIUM 43

Metabase is an open-source business intelligence and embedded analytics tool.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.01008 Published 2026-07-09 Fixed in 1.58.15.1, 1.59.12 +2 CWE-94

TI-2022-18736 CVE-2022-39361

Metabase vulnerable to Remote Code Execution via H2

MEDIUM 43

Metabase is data visualization software.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0125 Published 2022-10-26 Fixed in 0.41.9, 0.42.6 +6 CWE-20

TI-2023-15956 CVE-2023-32680

Missing SQL permissions check in metabase

MEDIUM 42

Metabase is an open source business analytics engine.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00598 Published 2023-05-18 Fixed in 0.44.7, 1.44.7 +4 CWE-306

TI-2022-18737 CVE-2022-39362

Metabase vulnerable to arbitrary SQL execution from queryhash

MEDIUM 42

Metabase is data visualization software.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01016 Published 2022-10-26 Fixed in 0.41.9, 0.42.6 +6 CWE-356

TI-2022-08665 CVE-2022-24854

Database bypassing any permissions in Metabase via SQlite attach

MEDIUM 42

Metabase is an open source business intelligence and analytics application.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01053 Published 2022-04-14 Fixed in 1.41.7, 0.41.7 +2 CWE-610

TI-2022-08666 CVE-2022-24855

XSS vulnerability in Metabase

MEDIUM 41

Metabase is an open source business intelligence and analytics application.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00712 Published 2022-04-14 Fixed in 1.40.8, 0.40.8 +4 CWE-79

TI-2026-26104 CVE-2026-33725

Metabase vulnerable to RCE and Arbitrary File Read via H2 JDBC INIT Injection in EE Serialization Import

LOW 35

Metabase is an open source business intelligence and embedded analytics tool.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00791 Published 2026-03-27 Fixed in 1.54.22, 1.55.22 +4 CWE-502

TI-2026-36916 CVE-2026-50147

Metabase: Arbitrary File Read via MySQL Connection Property Injection

LOW 33

Metabase is an open-source business intelligence and embedded analytics tool.

CVSS 3.1HIGH 7.6 Network High privileges No interaction EPSS 0.00339 Published 2026-07-15 Fixed in 1.57.19.1, 1.58.14.1 +2 CWE-88

TI-2026-21871 CVE-2026-27464

Metabase: Server-Side Template Injection via Notifications Endpoint Leads to RCE

LOW 33

Metabase is an open-source data analytics platform.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00299 Published 2026-02-21 Fixed in 0.57.13, 0.58.7 CWE-1336

TI-2022-21510 CVE-2022-43776 · GHSA-mppc-g8x5-rq8c

Server-side request forgery in Metabase

LOW 30

The url parameter of the /api/geojson endpoint in Metabase versions <44.5 can be used to perform Server Side Request Forgery attacks.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00798 Published 2022-10-26 Fixed in 44.5 CWE-918

TI-2022-18735 CVE-2022-39360

Metabase SSO users able to circumvent IdP login by doing password reset

LOW 30

Metabase is data visualization software.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00611 Published 2022-10-26 Fixed in 0.41.9, 0.42.6 +6 CWE-287

TI-2022-18734 CVE-2022-39359

Metabase's GeoJSON validation doesn't prevent redirects to blocked URLs

LOW 30

Metabase is data visualization software.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00727 Published 2022-10-26 Fixed in 0.41.9, 0.42.6 +6 CWE-200

TI-2022-18733 CVE-2022-39358

Metabase vulnerable to circumvention of Locked parameter in Signed Embedding

LOW 30

Metabase is data visualization software.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00538 Published 2022-10-26 Fixed in 0.42.6, 0.43.7 +4 CWE-200

TI-2018-00652 CVE-2018-0697 · GHSA-2446-mrf6-p2h8

Cross-site scripting in Metabase

LOW 29

Cross-site scripting vulnerability in Metabase version 0.29.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00842 Published 2018-11-15 No fix listed CWE-79

TI-2023-09458 CVE-2023-23629

Metabase subject to Improper Privilege Management

LOW 28

Metabase is an open source data analytics platform.

CVSS 3.1MEDIUM 6.3 Network Low privileges User interaction EPSS 0.00378 Published 2023-01-28 Fixed in 0.43.7.1, 0.44.6.1 +4 CWE-200

TI-2023-09457 CVE-2023-23628

Metabase subject to Exposure of Sensitive Information to an Unauthorized Actor

LOW 26

Metabase is an open source data analytics platform.

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.00438 Published 2023-01-28 Fixed in 0.43.7.1, 0.44.6.1 +4 CWE-200

TI-2025-19998 CVE-2025-27141

Metabase Enterprise Edition allows cached questions to leak data to impersonated users

LOW 22

Metabase Enterprise Edition is the enterprise version of Metabase business intelligence and data analytics software.

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.00364 Published 2025-02-24 Fixed in 1.50.36, 1.51.14 +2 CWE-732

Open these records in search →