Summary
Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL. In the worst case an attacker could gain administrative privileges.
Vulnerabilities 3
-
Critical 10.0
Metabase SQL injection via password reset endpoint
Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.
KEV Aug 11, 2026 -
Critical 10.0
Metabase SQL injection via public card or dashboard
Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter.
-
Medium 6.5
Metabase information exposure
Metabase allows an authenticated, low-privileged attacker to read the entire Metabase application database.
Revision history
-
#1.0.0
Initial publication