CVE Intelligence
Analysis AI-assisted

CVE-2026-103928: Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions

CVE-2026-103928 affects Metabase native queries and actions run against H2 data sources, which pass host-facing built-in functions through without restriction. According to the record, a user authorized to run native queries or actions can read or write arbitrary files on the server or link other databases, and the default sample database makes the surface exposed by default. The record lists fixed versions 1.58.16, 1.59.13, 1.60.9 and 1.61.4, and CVSS 4.0 base score 9.3 (critical).

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Metabase is an open source business intelligence and analytics platform. The record describes native queries and actions against an H2 data source that pass host-facing built-in functions through without restriction, so an authorized user can reach file read, file write, CSV and schema-linking functions. The vendor advisory is tracked as GHSA-cwxq-fmxq-jv8h and the CVE is listed in the NVD entry.

Impact

  • The record states that an authorized user can read or write arbitrary files on the Metabase server or link other databases.
  • The CVSS 4.0 vector in the record shows high confidentiality and high integrity impact on the vulnerable system, with no availability impact and no impact on subsequent systems.
  • The record gives a base score of 9.3 (critical) and an SSVC entry of automatable yes and total technical impact.
  • The default sample database uses H2, so the record indicates the exposed surface exists in default configurations.

Affected products and versions

  • Product: Metabase.
  • The description identifies the vulnerable range as starting at 1.55.0 and ending before 1.58.16, 1.59.13, 1.60.9 and 1.61.4.
  • The affected data also lists older ranges on the 0.x line, fixed in 0.58.15.3, 0.59.12.1, 0.60.8.1 and 0.61.3.4.
  • The record's fixes field is empty, so the fixed-version mapping above comes from the description and the affected ranges.

Exploitation status

  • The record shows KEV listed as false, so no confirmed active exploitation is recorded in the sources consulted.
  • EPSS data is missing in the record, so exploitation likelihood from EPSS is unknown.
  • The SSVC exploitation field is none in the record.

Remediation and mitigation

  • Upgrade Metabase to a fixed version on the relevant release line: 1.58.16, 1.59.13, 1.60.9 or 1.61.4, or the corresponding 0.x fixed release listed in the affected data.
  • Review which users hold permissions to run native queries or actions, and limit those permissions to users who need them.
  • Assess whether H2 data sources, including the default sample database, are in use and whether they can be removed or isolated where not needed.
  • The record does not describe a workaround, so any interim measure should be validated by the operator.

Detection guidance

  • Review Metabase audit and query logs for native queries or actions that reference file or CSV built-in functions or schema-linking functions, at a high level.
  • Look for unexpected file creation or modification on the Metabase host, particularly in locations the application does not normally write to.
  • Monitor for newly created links to other databases from H2 data sources.

Limitations of the available information

  • The record does not include a CWE name, only the identifier CWE-73.
  • EPSS data is null in the record.
  • The fixes field is empty, so the fixed-version mapping relies on the description and affected ranges.
  • The record does not include details on proof of concept, exploitation timeline or workarounds.

Frequently asked questions

What is CVE-2026-103928?

It is a critical issue in Metabase in which native queries and actions against H2 data sources pass host-facing built-in functions through without restriction. The record says authorized users can read or write arbitrary files on the server or link other databases.

Which versions are fixed?

The description states fixes in 1.58.16, 1.59.13, 1.60.9 and 1.61.4. The affected data also lists fixed 0.x releases 0.58.15.3, 0.59.12.1, 0.60.8.1 and 0.61.3.4.

Is this vulnerability being actively exploited?

The record shows KEV listed as false, and no confirmed exploitation appears in the sources consulted. EPSS data is missing from the record.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.