Skip to content
OpenAdvisories

Vendor

metabase

31 known vulnerabilities.

Products

metabase 31
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 10.0
    CVE-2026-72898 Exploited Public exploit Scanner template EPSS 98%

    Metabase SQL injection via password reset endpoint

    Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.

    metabase metabase
    KEV Aug 11, 2026
  • Critical 9.9
    CVE-2026-59827 Public exploit

    Metabase: Unsafe Deserialization of H2 Query Results

    Metabase is an open-source business intelligence and embedded analytics tool. Prior to 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4, Metabase instances with an H2 database connection, including the default sample database, deserialize arbitrary Java objects retur…

    metabase metabase
  • Critical 10.0
    CVE-2021-41277 Exploited Public exploit Scanner template EPSS 97%

    GeoJSON URL validation can expose server files and environment variables to unauthorized users

    Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment varia…

    metabase metabase
    KEV Nov 12, 2024