Vulnerabilidades do Metabase Metabase

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Metabase Metabase: 10 registro(s), com versões afetadas e correções.
cpe:2.3:a:metabase:metabase

CVE-2026-103928 Crítica · 9.3 CWE-73 13/10/2026

Metabase: leitura e gravação arbitrária de arquivos via funções internas inseguras do H2

Metabase é uma plataforma open source de business intelligence e análise de dados. Das versões 1.55.0 até 1.58.16, 1.59.13, 1.60.9 e 1.61.4, consultas nativas e ações contra uma fonte de dados H2 são repassadas sem restringir funções internas do H2 voltadas ao host. Um usuário autorizado a executar consultas nativas ou ações pode invocar FILE_READ, FILE_WRITE, CSVREAD, CSVWRITE ou LINK_SCHEMA para ler ou gravar arquivos arbitrários no servidor do Metabase ou vincular outros bancos de dados. O banco de dados de exemplo padrão usa H2, portanto a superfície vulnerável fica exposta por padrão. Este problema está corrigido nas versões 1.58.16, 1.59.13, 1.60.9 e 1.61.4.

CVE-2026-72898 Crítica · 10.0 KEV Urgente · 73 Exploit público CWE-89 10/08/2026

Metabase SQL Injection Vulnerability

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.

CVE-2026-50148 Crítica · 9.1 CWE-73 15/07/2026

Metabase is an open-source business intelligence and embedded analytics tool. From…

Metabase is an open-source business intelligence and embedded analytics tool. From 1.54.0 until 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4, a Metabase user with permission to add or edit a database connection can achieve remote code execution on the Metabase server by configuring a Snowflake connection to an attacker-controlled server, because a flaw in the Snowflake JDBC driver can write arbitrary files anywhere on the Metabase host, including replacing one of Metabase's own database driver files that later executes inside the Metabase process. This issue is fixed in versions 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4.

CVE-2026-50147 Alta · 7.6 CWE-88 15/07/2026

Argument Injection em Metabase

Metabase is an open-source business intelligence and embedded analytics tool. From 1.57.0 until 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4, an attacker who can configure a Metabase database connection can read arbitrary files from the Metabase server's filesystem by adding unsafe JDBC parameters to a MySQL or MariaDB connection, causing the driver to read files from the Metabase host and expose the contents through queries against the connected database or through validation error messages. This issue is fixed in versions 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4.

CVE-2026-59827 Alta · 8.8 CWE-502 09/07/2026

Deserialization of Untrusted Data em Metabase

Metabase is an open-source business intelligence and embedded analytics tool. Prior to 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4, Metabase instances with an H2 database connection, including the default sample database, deserialize arbitrary Java objects returned in H2 native query result columns of type OTHER without validation, allowing an authenticated user who can run native H2 queries to execute code on the Metabase server. This issue is fixed in versions 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4.

CVE-2026-59826 Crítica · 9.1 CWE-94 09/07/2026

Code Injection em Metabase

Metabase is an open-source business intelligence and embedded analytics tool. From 1.55.0 until 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2, Metabase did not validate unsafe H2 connection properties on one database-creation code path, allowing an authenticated administrator to register a crafted H2 database connection and execute arbitrary Java code on the Metabase server. This issue is fixed in versions 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2.

CVE-2026-33725 Alta · 7.2 CWE-502 26/03/2026

Metabase vulnerable to RCE and Arbitrary File Read via H2 JDBC INIT Injection in EE Serialization Import

Metabase is an open source business intelligence and embedded analytics tool. In Metabase Enterprise prior to versions 1.54.22, 1.55.22, 1.56.22, 1.57.16, 1.58.10, and 1.59.4, authenticated admins on Metabase Enterprise Edition can achieve Remote Code Execution (RCE) and Arbitrary File Read via the `POST /api/ee/serialization/import` endpoint. A crafted serialization archive injects an `INIT` property into the H2 JDBC spec, which can execute arbitrary SQL during a database sync. We confirmed this was possible on Metabase Cloud. This only affects Metabase Enterprise. Metabase OSS lacks the affected codepaths. All versions of Metabase Enterprise that have serialization, which dates back to at least version 1.47, are affected. Metabase Enterprise versions 1.54.22, 1.55.22, 1.56.22, 1.57.16, 1.58.10, and 1.59.4 patch the issue. As a workaround, disable the serialization import endpoint in their Metabase instance to prevent access to the vulnerable codepaths.

CVE-2026-27464 Média · 6.5 CWE-94 21/02/2026

Metabase: Server-Side Template Injection via Notifications Endpoint Leads to RCE

Metabase is an open-source data analytics platform. In versions prior to 0.57.13 and versions 0.58.x through 0.58.6, authenticated users are able to retrieve sensitive information from a Metabase instance, including database access credentials. During testing, it was confirmed that a low-privileged user can extract sensitive information including database credentials, into the email body via template evaluation. This issue has been fixed in versions 0.57.13 and 0.58.7. To workaround this issue, users can disable notifications in their Metabase instance to disallow access to the vulnerable endpoints.

CVE-2026-22805 Alta · 8.6 CWE-918 12/01/2026

Metabase channel test endpoint can reach internal local addresses

Metabase is an open-source data analytics platform. Prior to 55.13, 56.3, and 57.1, self-hosted Metabase instances that allow users to create subscriptions could be potentially impacted if their Metabase is colocated with other unsecured resources. This vulnerability is fixed in 55.13, 56.3, and 57.1.

CVE-2021-41277 Alta · 7.5 KEV Alta · 69 Exploit público CWE-200 17/11/2021

Metabase GeoJSON API Local File Inclusion Vulnerability

Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you’re unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application.