Metabase vulnerabilities

Products

• Metabase 34

Newest

• metabase Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions CVE-2026-103928 9.3 CriticalOctober 13, 2026
• metabase Metabase through 0.63.18 SSRF via GeoJSON URL validation bypass CVE-2026-92813 6.9 MediumSeptember 16, 2026
• metabase Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API CVE-2026-86116 7.1 HighSeptember 5, 2026
• metabase Metabase information exposure CVE-2026-72900 7.1 HighAugust 10, 2026
• metabase Metabase SQL injection via public card or dashboard CVE-2026-72899 10.0 CriticalAugust 10, 2026
• metabase Metabase SQL injection via password reset endpoint CVE-2026-72898 In KEVPublic exploit EPSS 98.8% 10.0 CriticalAugust 10, 2026
• metabase Metabase: Arbitrary File Read via MySQL Connection Property Injection CVE-2026-50147 7.6 HighJuly 15, 2026
• metabase Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write CVE-2026-50148 10.0 CriticalJuly 15, 2026
• metabase Metabase: Arbitrary Code Execution via Database Connection Detail Bypass CVE-2026-59826 9.1 CriticalJuly 9, 2026
• metabase Metabase: Unsafe Deserialization of H2 Query Results CVE-2026-59827 Public exploit 9.9 CriticalJuly 9, 2026
• metabase Metabase vulnerable to RCE and Arbitrary File Read via H2 JDBC INIT Injection in EE Serialization Import CVE-2026-33725 Public exploit 7.2 HighMarch 27, 2026
• metabase Metabase: Server-Side Template Injection via Notifications Endpoint Leads to RCE CVE-2026-27464 7.7 HighFebruary 21, 2026
• metabase Metabase channel test endpoint can reach internal local addresses CVE-2026-22805 2.1 LowJanuary 12, 2026
• metabase Metabase dom.js parseDataUri redos CVE-2025-5895 5.3 MediumJune 9, 2025
• metabase Snowflake credentials logged by the Metabase backend CVE-2025-32382 1.8 LowApril 10, 2025
• metabase Metabase vulnerable to circumvention of local link access protection in GeoJson endpoint CVE-2025-30371 2.1 LowMarch 28, 2025
• metabase Metabase Enterprise Edition allows cached questions to leak data to impersonated users CVE-2025-27141 4.8 MediumFebruary 24, 2025
• metabase Metabase sandboxed users could see filter values from other sandboxed users CVE-2024-55951 4.8 MediumDecember 16, 2024
• metabase Metabase vulnerable to remote code execution via POST /api/setup/validate API endpoint CVE-2023-37470 10.0 CriticalAugust 4, 2023
• metabase Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to... CVE-2023-38646 Public exploit EPSS 99.5% 9.8 CriticalJuly 21, 2023
• metabase Missing SQL permissions check in metabase CVE-2023-32680 5.8 MediumMay 18, 2023
• metabase Metabase subject to Improper Privilege Management CVE-2023-23629 6.3 MediumJanuary 28, 2023
• metabase Metabase subject to Exposure of Sensitive Information to an Unauthorized Actor CVE-2023-23628 5.7 MediumJanuary 28, 2023
• metabase The url parameter of the /api/geojson endpoint in Metabase versions <44.5 can be used to perform... CVE-2022-43776 6.5 MediumOctober 26, 2022
• metabase Metabase vulnerable to arbitrary SQL execution from queryhash CVE-2022-39362 8.8 HighOctober 26, 2022
• metabase Metabase vulnerable to Remote Code Execution via H2 CVE-2022-39361 8.8 HighOctober 26, 2022
• metabase Metabase SSO users able to circumvent IdP login by doing password reset CVE-2022-39360 6.5 MediumOctober 26, 2022
• metabase Metabase's GeoJSON validation doesn't prevent redirects to blocked URLs CVE-2022-39359 6.5 MediumOctober 26, 2022
• metabase Metabase vulnerable to circumvention of Locked parameter in Signed Embedding CVE-2022-39358 6.5 MediumOctober 26, 2022
• metabase File system exposure in Metabase CVE-2022-24853 Public exploit 5.9 MediumApril 14, 2022
• metabase Database bypassing any permissions in Metabase via SQlite attach CVE-2022-24854 8.0 HighApril 14, 2022
• metabase XSS vulnerability in Metabase CVE-2022-24855 8.7 HighApril 14, 2022
• metabase GeoJSON URL validation can expose server files and environment variables to unauthorized users CVE-2021-41277 In KEVPublic exploit EPSS 97.2% 10.0 CriticalNovember 17, 2021
• metabase Cross-site scripting vulnerability in Metabase version 0.29.3 and earlier allows remote attackers... CVE-2018-0697 6.1 MediumNovember 15, 2018