Vulnerabilities

TI-2026-71834 CVE-2026-103928

Arbitrary file read and write in Metabase via H2 built-in functions

MEDIUM 48

Metabase is an open source business intelligence and analytics platform.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00407 Published 2026-10-13 Fixed in 1.58.16, 1.59.13 +6 CWE-73

TI-2026-62552 CVE-2026-92813 · GHSA-vhcq-xc7j-xfj8

Metabase through 0.63.18 SSRF via GeoJSON URL validation bypass

MEDIUM 64

Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing unauthenticated attackers to reach loopback services.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00474 Published 2026-09-16 No fix listed CWE-918

TI-2026-58915 CVE-2026-86116 · GHSA-cvjh-3gm5-9h6f

Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API

MEDIUM 64

Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.0043 Published 2026-09-05 Fixed in 0.63.1 CWE-862

TI-2026-51117 CVE-2026-72900

Metabase information exposure

LOW 31

Metabase allows an authenticated, low-privileged attacker to read the entire Metabase application database.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00402 Published 2026-08-10 Fixed in x.58.24, x.59.21 +4 CWE-862

TI-2026-51116 CVE-2026-72899

Metabase SQL injection via public card or dashboard

MEDIUM 50

Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00787 Published 2026-08-10 Fixed in x.58.24, x.59.21 +4 CWE-89

TI-2026-51115 CVE-2026-72898

Metabase SQL injection via password reset endpoint

CRITICAL 100KEV

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.98809 Published 2026-08-10 Fixed in x.58.24, x.59.21 +4 CWE-89

TI-2026-36916 CVE-2026-50147

Metabase: Arbitrary File Read via MySQL Connection Property Injection

LOW 33

Metabase is an open-source business intelligence and embedded analytics tool.

CVSS 3.1HIGH 7.6 Network High privileges No interaction EPSS 0.00339 Published 2026-07-15 Fixed in 1.57.19.1, 1.58.14.1 +2 CWE-88

TI-2026-36917 CVE-2026-50148

Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write

MEDIUM 50

Metabase is an open-source business intelligence and embedded analytics tool.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00768 Published 2026-07-15 Fixed in 1.54.24, 1.55.24 +5 CWE-73

TI-2026-42642 CVE-2026-59826

Metabase: Arbitrary Code Execution via Database Connection Detail Bypass

MEDIUM 43

Metabase is an open-source business intelligence and embedded analytics tool.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.01008 Published 2026-07-09 Fixed in 1.58.15.1, 1.59.12 +2 CWE-94

TI-2026-42643 CVE-2026-59827

Metabase: Unsafe Deserialization of H2 Query Results

MEDIUM 49

Metabase is an open-source business intelligence and embedded analytics tool.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.03788 Published 2026-07-09 Fixed in 1.58.15, 1.59.12 +2 CWE-502

TI-2026-26104 CVE-2026-33725

Metabase vulnerable to RCE and Arbitrary File Read via H2 JDBC INIT Injection in EE Serialization Import

LOW 35

Metabase is an open source business intelligence and embedded analytics tool.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00791 Published 2026-03-27 Fixed in 1.54.22, 1.55.22 +4 CWE-502

TI-2026-21871 CVE-2026-27464

Metabase: Server-Side Template Injection via Notifications Endpoint Leads to RCE

LOW 33

Metabase is an open-source data analytics platform.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00299 Published 2026-02-21 Fixed in 0.57.13, 0.58.7 CWE-1336

TI-2026-18322 CVE-2026-22805

Metabase channel test endpoint can reach internal local addresses

LOW 11

Metabase is an open-source data analytics platform.

CVSS 4.0LOW 2.1 Network High privileges No interaction EPSS 0.0024 Published 2026-01-12 Fixed in 57.1, 56.3 +1 CWE-918

TI-2025-05321 CVE-2025-5895 · GHSA-94cm-j3mf-q873

Metabase dom.js parseDataUri redos

MEDIUM 57

A vulnerability was found in Metabase 54.10.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0067 Published 2025-06-09 No fix listed CWE-1333

TI-2025-23461 CVE-2025-32382

Snowflake credentials logged by the Metabase backend

LOW 10

Metabase is an open source Business Intelligence and Embedded Analytics tool.

CVSS 4.0LOW 1.8 Network High privileges User interaction EPSS 0.00392 Published 2025-04-10 Fixed in 0.52.17.1, 1.52.17.1 +4 CWE-532

TI-2025-21677 CVE-2025-30371

Metabase vulnerable to circumvention of local link access protection in GeoJson endpoint

LOW 12

Metabase is a business intelligence and embedded analytics tool.

CVSS 4.0LOW 2.1 Network High privileges No interaction EPSS 0.00427 Published 2025-03-28 Fixed in 0.52.16.4, 1.52.16.4 +2 CWE-59

TI-2025-19998 CVE-2025-27141

Metabase Enterprise Edition allows cached questions to leak data to impersonated users

LOW 22

Metabase Enterprise Edition is the enterprise version of Metabase business intelligence and data analytics software.

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.00364 Published 2025-02-24 Fixed in 1.50.36, 1.51.14 +2 CWE-732

TI-2024-36992 CVE-2024-55951

Metabase sandboxed users could see filter values from other sandboxed users

LOW 22

Metabase is an open-source data analytics platform.

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.00437 Published 2024-12-16 Fixed in 1.52.2.5 CWE-200

TI-2023-19078 CVE-2023-37470

Metabase vulnerable to remote code execution via POST /api/setup/validate API endpoint

MEDIUM 52

Metabase is an open-source business intelligence and analytics platform.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01349 Published 2023-08-04 Fixed in 0.43.7.3, 0.44.7.3 +6 CWE-94

TI-2023-20003 CVE-2023-38646 · GHSA-jg32-8h6w-x7vg

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow…

CRITICAL 87

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99478 Published 2023-07-21 No fix listed

TI-2023-15956 CVE-2023-32680

Missing SQL permissions check in metabase

MEDIUM 42

Metabase is an open source business analytics engine.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00598 Published 2023-05-18 Fixed in 0.44.7, 1.44.7 +4 CWE-306

TI-2023-09458 CVE-2023-23629

Metabase subject to Improper Privilege Management

LOW 28

Metabase is an open source data analytics platform.

CVSS 3.1MEDIUM 6.3 Network Low privileges User interaction EPSS 0.00378 Published 2023-01-28 Fixed in 0.43.7.1, 0.44.6.1 +4 CWE-200

TI-2023-09457 CVE-2023-23628

Metabase subject to Exposure of Sensitive Information to an Unauthorized Actor

LOW 26

Metabase is an open source data analytics platform.

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.00438 Published 2023-01-28 Fixed in 0.43.7.1, 0.44.6.1 +4 CWE-200

TI-2022-21510 CVE-2022-43776 · GHSA-mppc-g8x5-rq8c

Server-side request forgery in Metabase

LOW 30

The url parameter of the /api/geojson endpoint in Metabase versions <44.5 can be used to perform Server Side Request Forgery attacks.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00798 Published 2022-10-26 Fixed in 44.5 CWE-918

TI-2022-18737 CVE-2022-39362

Metabase vulnerable to arbitrary SQL execution from queryhash

MEDIUM 42

Metabase is data visualization software.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01016 Published 2022-10-26 Fixed in 0.41.9, 0.42.6 +6 CWE-356

Vulnerabilities

Filters