Advisories · Technology

metabase.

Every CVE that names metabase among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-103928 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions
- metabase
- Path traversal
Not analysed yet 13 Oct 2026
CVE-2026-92813 CVE record

CVSS 6.9 Medium

Metabase through 0.63.18 SSRF via GeoJSON URL validation bypass
- Metabase
- Server-side request forgery (SSRF)
Not analysed yet 16 Sept 2026
CVE-2026-86116 CVE record

CVSS 7.1 High

Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API
- metabase
- Broken access control
Not analysed yet 5 Sept 2026
CVE-2026-72900 CVE record

CVSS 7.1 High

Metabase information exposure
- Metabase
- Broken access control
Not analysed yet 10 Aug 2026
CVE-2026-72899 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Metabase SQL injection via public card or dashboard
- Metabase
- SQL injection
Not analysed yet 10 Aug 2026
CVE-2026-72898 CVE record

CVSS 10.0 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

Metabase SQL injection via password reset endpoint
- Metabase
- SQL injection
Not analysed yet 10 Aug 2026
CVE-2026-50147 CVE record

CVSS 7.6 High

Metabase: Arbitrary File Read via MySQL Connection Property Injection
- metabase
- Command injection
Not analysed yet 15 Jul 2026
CVE-2026-50148 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write
- metabase
- Path traversal
Not analysed yet 15 Jul 2026
CVE-2026-59826 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Metabase: Arbitrary Code Execution via Database Connection Detail Bypass
- metabase
- Code injection
Not analysed yet 9 Jul 2026
CVE-2026-59827 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

Metabase: Unsafe Deserialization of H2 Query Results
- metabase
- Insecure deserialization
Not analysed yet 9 Jul 2026
CVE-2026-33725 CVE record

CVSS 7.2 High

Metabase vulnerable to RCE and Arbitrary File Read via H2 JDBC INIT Injection in EE Serialization Import
- metabase
- Insecure deserialization
Not analysed yet 27 Mar 2026
CVE-2026-27464 CVE record

CVSS 7.7 High

Metabase: Server-Side Template Injection via Notifications Endpoint Leads to RCE
- metabase
- Code injection
Not analysed yet 21 Feb 2026
CVE-2026-22805 CVE record

CVSS 2.1 Low

Metabase channel test endpoint can reach internal local addresses
- metabase
- Server-side request forgery (SSRF)
Not analysed yet 12 Jan 2026
CVE-2025-5895 CVE record

CVSS 5.3 Medium

Metabase dom.js parseDataUri redos
- Metabase
- Denial of service
Not analysed yet 9 Jun 2025
CVE-2025-32382 CVE record

CVSS 1.8 Low

Snowflake credentials logged by the Metabase backend
- metabase
- Information disclosure
Not analysed yet 10 Apr 2025
CVE-2025-30371 CVE record

CVSS 2.1 Low

Metabase vulnerable to circumvention of local link access protection in GeoJson endpoint
- metabase
- Path traversal
Not analysed yet 28 Mar 2025
CVE-2025-27141 CVE record

CVSS 4.8 Medium

Metabase Enterprise Edition allows cached questions to leak data to impersonated users
- metabase
- Broken access control
Not analysed yet 24 Feb 2025
CVE-2024-55951 CVE record

CVSS 4.8 Medium

Metabase sandboxed users could see filter values from other sandboxed users
- metabase
- Information disclosure
Not analysed yet 16 Dec 2024
CVE-2023-37470 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Metabase vulnerable to remote code execution via POST /api/setup/validate API endpoint
- metabase
- Code injection
Not analysed yet 4 Aug 2023
CVE-2023-32680 CVE record

CVSS 5.8 Medium

Missing SQL permissions check in metabase
- metabase
- Authentication bypass
Not analysed yet 18 May 2023
CVE-2023-23629 CVE record

CVSS 6.3 Medium

Metabase subject to Improper Privilege Management
- metabase
- Information disclosure
- Privilege escalation
Not analysed yet 28 Jan 2023
CVE-2023-23628 CVE record

CVSS 5.7 Medium

Metabase subject to Exposure of Sensitive Information to an Unauthorized Actor
- metabase
- Information disclosure
Not analysed yet 28 Jan 2023
CVE-2022-43776 CVE record

CVSS 6.5 Medium

Server-side request forgery in Metabase
- Metabase
- Server-side request forgery (SSRF)
Not analysed yet 26 Oct 2022
CVE-2022-39362 CVE record

CVSS 8.8 High

Metabase vulnerable to arbitrary SQL execution from queryhash
- metabase
- CWE-356
Not analysed yet 26 Oct 2022
CVE-2022-39361 CVE record

CVSS 8.8 High

Metabase vulnerable to Remote Code Execution via H2
- metabase
- CWE-20
- CWE-441
Not analysed yet 26 Oct 2022
CVE-2022-39360 CVE record

CVSS 6.5 Medium

Metabase SSO users able to circumvent IdP login by doing password reset
- metabase
- Authentication bypass
Not analysed yet 26 Oct 2022
CVE-2022-39359 CVE record

CVSS 6.5 Medium

Metabase's GeoJSON validation doesn't prevent redirects to blocked URLs
- metabase
- Information disclosure
Not analysed yet 26 Oct 2022
CVE-2022-39358 CVE record

CVSS 6.5 Medium

Metabase vulnerable to circumvention of Locked parameter in Signed Embedding
- metabase
- Information disclosure
Not analysed yet 26 Oct 2022
CVE-2022-24853 CVE record

CVSS 5.9 Medium

File system exposure in Metabase
- metabase
- Information disclosure
Not analysed yet 14 Apr 2022
CVE-2022-24854 CVE record

CVSS 8.0 High

Database bypassing any permissions in Metabase via SQlite attach
- metabase
- CWE-610
Not analysed yet 14 Apr 2022
CVE-2022-24855 CVE record

CVSS 8.7 High

XSS vulnerability in Metabase
- metabase
- Cross-site scripting (XSS)
Not analysed yet 14 Apr 2022
CVE-2021-41277 CVE record

CVSS 10.0 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

GeoJSON URL validation can expose server files and environment variables to unauthorized users
- metabase
- Information disclosure
Not analysed yet 17 Nov 2021
CVE-2018-0697 CVE record

Metabase: Cross-site scripting vulnerability in Metabase version 0.29.3 and earlier allows remote…
- Metabase
Not analysed yet 15 Nov 2018