Metabase vulnerabilities
31 CVEs and advisories name Metabase as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-103928Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions
- CVE-2026-92813Metabase through 0.63.18 SSRF via GeoJSON URL validation bypass
- CVE-2026-86116Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API
- CVE-2026-72900Metabase information exposure
- CVE-2026-72899Metabase SQL injection via public card or dashboard
- CVE-2026-72898Metabase SQL injection via password reset endpoint
- CVE-2026-50147Metabase: Arbitrary File Read via MySQL Connection Property Injection
- CVE-2026-50148Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write
- CVE-2026-59826Metabase: Arbitrary Code Execution via Database Connection Detail Bypass
- CVE-2026-59827Metabase: Unsafe Deserialization of H2 Query Results
- CVE-2026-33725Metabase vulnerable to RCE and Arbitrary File Read via H2 JDBC INIT Injection in EE Serialization Import
- CVE-2026-27464Metabase: Server-Side Template Injection via Notifications Endpoint Leads to RCE
- CVE-2026-22805Metabase channel test endpoint can reach internal local addresses
- CVE-2025-32382Snowflake credentials logged by the Metabase backend
- CVE-2025-30371Metabase vulnerable to circumvention of local link access protection in GeoJson endpoint
- CVE-2025-27141Metabase Enterprise Edition allows cached questions to leak data to impersonated users
- CVE-2024-55951Metabase sandboxed users could see filter values from other sandboxed users
- CVE-2023-37470Metabase vulnerable to remote code execution via POST /api/setup/validate API endpoint
- CVE-2023-32680Missing SQL permissions check in metabase
- CVE-2023-23629Metabase subject to Improper Privilege Management
- CVE-2023-23628Metabase subject to Exposure of Sensitive Information to an Unauthorized Actor
- CVE-2022-39362Metabase vulnerable to arbitrary SQL execution from queryhash
- CVE-2022-39361Metabase vulnerable to Remote Code Execution via H2
- CVE-2022-39360Metabase SSO users able to circumvent IdP login by doing password reset
- CVE-2022-39359Metabase's GeoJSON validation doesn't prevent redirects to blocked URLs
- CVE-2022-39358Metabase vulnerable to circumvention of Locked parameter in Signed Embedding
- CVE-2022-24853File system exposure in Metabase
- CVE-2022-24854Database bypassing any permissions in Metabase via SQlite attach
- CVE-2022-24855XSS vulnerability in Metabase
- CVE-2021-41277GeoJSON URL validation can expose server files and environment variables to unauthorized users