Skip to content
OpenAdvisories

Vendor

metabase

31 known vulnerabilities.

Products

metabase 31
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 10.0
    CVE-2026-72898 Exploited Public exploit EPSS 98%

    Metabase SQL injection via password reset endpoint

    Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.

    metabase metabase
    KEV Aug 11, 2026
  • Critical 10.0
    CVE-2021-41277 Exploited Public exploit EPSS 97%

    GeoJSON URL validation can expose server files and environment variables to unauthorized users

    Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment varia…

    metabase metabase
    KEV Nov 12, 2024