Skip to content
OpenAdvisories

Vendor

metabase

31 known vulnerabilities.

Products

metabase 31
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 7.6
    CVE-2026-50147

    Metabase: Arbitrary File Read via MySQL Connection Property Injection

    Metabase is an open-source business intelligence and embedded analytics tool. From 1.57.0 until 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4, an attacker who can configure a Metabase database connection can read arbitrary files from the Metabase server's filesys…

    metabase metabase
  • High 7.2
    CVE-2026-33725 Public exploit

    Metabase vulnerable to RCE and Arbitrary File Read via H2 JDBC INIT Injection in EE Serialization Import

    Metabase is an open source business intelligence and embedded analytics tool. In Metabase Enterprise prior to versions 1.54.22, 1.55.22, 1.56.22, 1.57.16, 1.58.10, and 1.59.4, authenticated admins on Metabase Enterprise Edition can achieve Remote Code Executi…

    metabase metabase
  • High 7.7
    CVE-2026-27464

    Metabase: Server-Side Template Injection via Notifications Endpoint Leads to RCE

    Metabase is an open-source data analytics platform. In versions prior to 0.57.13 and versions 0.58.x through 0.58.6, authenticated users are able to retrieve sensitive information from a Metabase instance, including database access credentials. During testing…

    metabase metabase
  • High 8.8
    CVE-2022-39362

    Metabase vulnerable to arbitrary SQL execution from queryhash

    Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, unsaved SQL queries are auto-executed, which could pose a possible attack vector. This issue is patched in versions 0.44.5, 1.44.5, …

    metabase metabase
  • High 8.8
    CVE-2022-39361

    Metabase vulnerable to Remote Code Execution via H2

    Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, H2 (Sample Database) could allow Remote Code Execution (RCE), which can be abused by users able to write SQL queries on H2 databases…

    metabase metabase
  • High 8.0
    CVE-2022-24854

    Database bypassing any permissions in Metabase via SQlite attach

    Metabase is an open source business intelligence and analytics application. SQLite has an FDW-like feature called `ATTACH DATABASE`, which allows connecting multiple SQLite databases via the initial connection. If the attacker has SQL permissions to at least …

    metabase metabase
  • High 8.7
    CVE-2022-24855

    XSS vulnerability in Metabase

    Metabase is an open source business intelligence and analytics application. In affected versions Metabase ships with an internal development endpoint `/_internal` that can allow for cross site scripting (XSS) attacks, potentially leading to phishing attempts …

    metabase metabase