Vulnerabilities

TI-2026-51115 CVE-2026-72898

Metabase SQL injection via password reset endpoint

CRITICAL 100KEV

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.98208 Published 2026-08-10 Fixed in x.58.24, x.59.21 +4 CWE-89

TI-2026-36916 CVE-2026-50147

Metabase: Arbitrary File Read via MySQL Connection Property Injection

LOW 33

Metabase is an open-source business intelligence and embedded analytics tool.

CVSS 3.1HIGH 7.6 Network High privileges No interaction EPSS 0.00339 Published 2026-07-15 Fixed in 1.57.19.1, 1.58.14.1 +2 CWE-88

TI-2026-36917 CVE-2026-50148

Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write

MEDIUM 50

Metabase is an open-source business intelligence and embedded analytics tool.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00768 Published 2026-07-15 Fixed in 1.54.24, 1.55.24 +5 CWE-73

TI-2026-42642 CVE-2026-59826

Metabase: Arbitrary Code Execution via Database Connection Detail Bypass

MEDIUM 43

Metabase is an open-source business intelligence and embedded analytics tool.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.01008 Published 2026-07-09 Fixed in 1.58.15.1, 1.59.12 +2 CWE-94

TI-2026-42643 CVE-2026-59827

Metabase: Unsafe Deserialization of H2 Query Results

MEDIUM 49

Metabase is an open-source business intelligence and embedded analytics tool.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.03788 Published 2026-07-09 Fixed in 1.58.15, 1.59.12 +2 CWE-502

TI-2026-26104 CVE-2026-33725

Metabase vulnerable to RCE and Arbitrary File Read via H2 JDBC INIT Injection in EE Serialization Import

LOW 35

Metabase is an open source business intelligence and embedded analytics tool.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00791 Published 2026-03-27 Fixed in 1.54.22, 1.55.22 +4 CWE-502

TI-2026-21871 CVE-2026-27464

Metabase: Server-Side Template Injection via Notifications Endpoint Leads to RCE

LOW 33

Metabase is an open-source data analytics platform.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00299 Published 2026-02-21 Fixed in 0.57.13, 0.58.7 CWE-1336

TI-2026-18322 CVE-2026-22805

Metabase channel test endpoint can reach internal local addresses

LOW 11

Metabase is an open-source data analytics platform.

CVSS 4.0LOW 2.1 Network High privileges No interaction EPSS 0.0024 Published 2026-01-12 Fixed in 57.1, 56.3 +1 CWE-918

TI-2025-05321 CVE-2025-5895 · GHSA-94cm-j3mf-q873

Metabase dom.js parseDataUri redos

MEDIUM 57

A vulnerability was found in Metabase 54.10.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0067 Published 2025-06-09 No fix listed CWE-1333

TI-2025-19998 CVE-2025-27141

Metabase Enterprise Edition allows cached questions to leak data to impersonated users

LOW 22

Metabase Enterprise Edition is the enterprise version of Metabase business intelligence and data analytics software.

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.00364 Published 2025-02-24 Fixed in 1.50.36, 1.51.14 +2 CWE-732

TI-2023-19078 CVE-2023-37470

Metabase vulnerable to remote code execution via POST /api/setup/validate API endpoint

MEDIUM 52

Metabase is an open-source business intelligence and analytics platform.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01349 Published 2023-08-04 Fixed in 0.43.7.3, 0.44.7.3 +6 CWE-94

TI-2023-20003 CVE-2023-38646 · GHSA-jg32-8h6w-x7vg

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow…

CRITICAL 87

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99478 Published 2023-07-21 No fix listed

TI-2023-15956 CVE-2023-32680

Missing SQL permissions check in metabase

MEDIUM 42

Metabase is an open source business analytics engine.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00598 Published 2023-05-18 Fixed in 0.44.7, 1.44.7 +4 CWE-306

TI-2023-09458 CVE-2023-23629

Metabase subject to Improper Privilege Management

LOW 28

Metabase is an open source data analytics platform.

CVSS 3.1MEDIUM 6.3 Network Low privileges User interaction EPSS 0.00388 Published 2023-01-28 Fixed in 0.43.7.1, 0.44.6.1 +4 CWE-200

TI-2023-09457 CVE-2023-23628

Metabase subject to Exposure of Sensitive Information to an Unauthorized Actor

LOW 26

Metabase is an open source data analytics platform.

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.0045 Published 2023-01-28 Fixed in 0.43.7.1, 0.44.6.1 +4 CWE-200

TI-2022-21510 CVE-2022-43776 · GHSA-mppc-g8x5-rq8c

Server-side request forgery in Metabase

LOW 30

The url parameter of the /api/geojson endpoint in Metabase versions <44.5 can be used to perform Server Side Request Forgery attacks.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00798 Published 2022-10-26 Fixed in 44.5 CWE-918

TI-2022-18737 CVE-2022-39362