# cve.now: Metabase

The newest entries naming Metabase as an affected vendor (up to 200), of 31 in all, 2 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-103928](https://cve.now/CVE-2026-103928.md): Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions (CVSS 9.3)
- [CVE-2026-92813](https://cve.now/CVE-2026-92813.md): Metabase through 0.63.18 SSRF via GeoJSON URL validation bypass (CVSS 6.9)
- [CVE-2026-86116](https://cve.now/CVE-2026-86116.md): Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API (CVSS 7.1)
- [CVE-2026-72900](https://cve.now/CVE-2026-72900.md): Metabase information exposure (CVSS 6.5)
- [CVE-2026-72899](https://cve.now/CVE-2026-72899.md): Metabase SQL injection via public card or dashboard (CVSS 10.0)
- [CVE-2026-72898](https://cve.now/CVE-2026-72898.md): Metabase SQL injection via password reset endpoint (CVSS 10.0, KEV)
- [CVE-2026-50147](https://cve.now/CVE-2026-50147.md): Metabase: Arbitrary File Read via MySQL Connection Property Injection (CVSS 7.6)
- [CVE-2026-50148](https://cve.now/CVE-2026-50148.md): Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write (CVSS 10.0)
- [CVE-2026-59826](https://cve.now/CVE-2026-59826.md): Metabase: Arbitrary Code Execution via Database Connection Detail Bypass (CVSS 9.1)
- [CVE-2026-59827](https://cve.now/CVE-2026-59827.md): Metabase: Unsafe Deserialization of H2 Query Results (CVSS 9.9)
- [CVE-2026-33725](https://cve.now/CVE-2026-33725.md): Metabase vulnerable to RCE and Arbitrary File Read via H2 JDBC INIT Injection in EE Serialization Import (CVSS 7.2)
- [CVE-2026-27464](https://cve.now/CVE-2026-27464.md): Metabase: Server-Side Template Injection via Notifications Endpoint Leads to RCE (CVSS 7.7)
- [CVE-2026-22805](https://cve.now/CVE-2026-22805.md): Metabase channel test endpoint can reach internal local addresses (CVSS 2.1)
- [CVE-2025-32382](https://cve.now/CVE-2025-32382.md): Snowflake credentials logged by the Metabase backend (CVSS 1.8)
- [CVE-2025-30371](https://cve.now/CVE-2025-30371.md): Metabase vulnerable to circumvention of local link access protection in GeoJson endpoint (CVSS 2.1)
- [CVE-2025-27141](https://cve.now/CVE-2025-27141.md): Metabase Enterprise Edition allows cached questions to leak data to impersonated users (CVSS 4.8)
- [CVE-2024-55951](https://cve.now/CVE-2024-55951.md): Metabase sandboxed users could see filter values from other sandboxed users (CVSS 4.8)
- [CVE-2023-37470](https://cve.now/CVE-2023-37470.md): Metabase vulnerable to remote code execution via POST /api/setup/validate API endpoint (CVSS 10.0)
- [CVE-2023-32680](https://cve.now/CVE-2023-32680.md): Missing SQL permissions check in metabase (CVSS 5.8)
- [CVE-2023-23629](https://cve.now/CVE-2023-23629.md): Metabase subject to Improper Privilege Management (CVSS 6.3)
- [CVE-2023-23628](https://cve.now/CVE-2023-23628.md): Metabase subject to Exposure of Sensitive Information to an Unauthorized Actor (CVSS 5.7)
- [CVE-2022-39362](https://cve.now/CVE-2022-39362.md): Metabase vulnerable to arbitrary SQL execution from queryhash (CVSS 8.8)
- [CVE-2022-39361](https://cve.now/CVE-2022-39361.md): Metabase vulnerable to Remote Code Execution via H2 (CVSS 8.8)
- [CVE-2022-39360](https://cve.now/CVE-2022-39360.md): Metabase SSO users able to circumvent IdP login by doing password reset (CVSS 6.5)
- [CVE-2022-39359](https://cve.now/CVE-2022-39359.md): Metabase's GeoJSON validation doesn't prevent redirects to blocked URLs (CVSS 6.5)
- [CVE-2022-39358](https://cve.now/CVE-2022-39358.md): Metabase vulnerable to circumvention of Locked parameter in Signed Embedding (CVSS 6.5)
- [CVE-2022-24853](https://cve.now/CVE-2022-24853.md): File system exposure in Metabase (CVSS 5.9)
- [CVE-2022-24854](https://cve.now/CVE-2022-24854.md): Database bypassing any permissions in Metabase via SQlite attach (CVSS 8.0)
- [CVE-2022-24855](https://cve.now/CVE-2022-24855.md): XSS vulnerability in Metabase (CVSS 8.7)
- [CVE-2021-41277](https://cve.now/CVE-2021-41277.md): GeoJSON URL validation can expose server files and environment variables to unauthorized users (CVSS 10.0, KEV)
- [CVE-2018-0697](https://cve.now/CVE-2018-0697.md): Cross-site scripting vulnerability in Metabase version 0.29.3 and earlier allows remote attackers to inject arbitrary web script or HTML via (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/metabase
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.