Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Metabase x.58.24, x.59.21 and 4 more versions Clear all filters
TI-2026-51117 CVE-2026-72900

Metabase information exposure

Priority LOW 31

Metabase allows an authenticated, low-privileged attacker to read the entire Metabase application database.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00402 Published 2026-08-10 Fixed in x.58.24, x.59.21 +4 CWE-862
TI-2026-51116 CVE-2026-72899

Metabase SQL injection via public card or dashboard

Priority MEDIUM 50

Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00787 Published 2026-08-10 Fixed in x.58.24, x.59.21 +4 CWE-89
TI-2026-51115 CVE-2026-72898

Metabase SQL injection via password reset endpoint

Priority CRITICAL 100KEV

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.98208 Published 2026-08-10 Fixed in x.58.24, x.59.21 +4 CWE-89