Description
Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Metabase | Metabase | x.58.0 – < x.58.24, x.59.0 – < x.59.21, x.60.0 – < x.60.17, x.61.0 – < x.61.11, x.62.0 – < x.62.9, x.63.0 – < x.63.5 | x.58.24 |
Advisories 2
- WID-SEC-2026-2738 Metabase: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 10, 2026
- VA-26-222-01 Metabase SQL injection CISA ICS & IT advisories · Aug 10, 2026