Vulnerabilidades de Metabase
CVEs publicadas que afetam produtos de Metabase: 6 registro(s), com severidade, exploração e correções.
CVE-2026-103928
Crítica · 9.3
CWE-73 13/10/2026
Metabase: leitura e gravação arbitrária de arquivos via funções internas inseguras do H2
Metabase é uma plataforma open source de business intelligence e análise de dados. Das versões 1.55.0 até 1.58.16, 1.59.13, 1.60.9 e 1.61.4, consultas nativas e ações contra uma fonte de dados H2 são repassadas sem restringir funções internas do H2 voltadas ao host. Um usuário autorizado a executar consultas nativas ou ações pode invocar FILE_READ, FILE_WRITE, CSVREAD, CSVWRITE ou LINK_SCHEMA para ler ou gravar arquivos arbitrários no servidor do Metabase ou vincular outros bancos de dados. O banco de dados de exemplo padrão usa H2, portanto a superfície vulnerável fica exposta por padrão. Este problema está corrigido nas versões 1.58.16, 1.59.13, 1.60.9 e 1.61.4.
CVE-2026-72898
Crítica · 10.0
KEV Urgente · 73 Exploit público CWE-89 10/08/2026
Metabase SQL Injection Vulnerability
Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.
CVE-2026-33725
Alta · 7.2
CWE-502 26/03/2026
Metabase vulnerable to RCE and Arbitrary File Read via H2 JDBC INIT Injection in EE Serialization Import
Metabase is an open source business intelligence and embedded analytics tool. In Metabase Enterprise prior to versions 1.54.22, 1.55.22, 1.56.22, 1.57.16, 1.58.10, and 1.59.4, authenticated admins on Metabase Enterprise Edition can achieve Remote Code Execution (RCE) and Arbitrary File Read via the `POST /api/ee/serialization/import` endpoint. A crafted serialization archive injects an `INIT` property into the H2 JDBC spec, which can execute arbitrary SQL during a database sync. We confirmed this was possible on Metabase Cloud. This only affects Metabase Enterprise. Metabase OSS lacks the affected codepaths. All versions of Metabase Enterprise that have serialization, which dates back to at least version 1.47, are affected. Metabase Enterprise versions 1.54.22, 1.55.22, 1.56.22, 1.57.16, 1.58.10, and 1.59.4 patch the issue. As a workaround, disable the serialization import endpoint in their Metabase instance to prevent access to the vulnerable codepaths.
CVE-2026-27464
Média · 6.5
CWE-94 21/02/2026
Metabase: Server-Side Template Injection via Notifications Endpoint Leads to RCE
Metabase is an open-source data analytics platform. In versions prior to 0.57.13 and versions 0.58.x through 0.58.6, authenticated users are able to retrieve sensitive information from a Metabase instance, including database access credentials. During testing, it was confirmed that a low-privileged user can extract sensitive information including database credentials, into the email body via template evaluation. This issue has been fixed in versions 0.57.13 and 0.58.7. To workaround this issue, users can disable notifications in their Metabase instance to disallow access to the vulnerable endpoints.
CVE-2026-22805
Alta · 8.6
CWE-918 12/01/2026
Metabase channel test endpoint can reach internal local addresses
Metabase is an open-source data analytics platform. Prior to 55.13, 56.3, and 57.1, self-hosted Metabase instances that allow users to create subscriptions could be potentially impacted if their Metabase is colocated with other unsecured resources. This vulnerability is fixed in 55.13, 56.3, and 57.1.
CVE-2021-41277
Alta · 7.5
KEV Alta · 69 Exploit público CWE-200 17/11/2021
Metabase GeoJSON API Local File Inclusion Vulnerability
Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you’re unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application.