Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Metabase — Vulnerabilities & Security Advisories 32

All 32 CVE vulnerabilities found in Metabase, with AI-generated Chinese analysis, references, and POCs.

This aggregation page catalogues security vulnerabilities affecting Metabase, an open-source business intelligence tool, categorized by vendor, product, and specific weakness types. The repository compiles disclosed security defects reported for Metabase over a defined historical period, covering various flaw classes such as injection, cross-site scripting, and authentication bypasses. Users can leverage this resource to track the vendor's advisory history, analyze the prevalence of specific weakness categories, and review the product's complete vulnerability timeline. By consolidating data from multiple sources, the page helps security teams evaluate risk trends, compare past and present exposure, and inform patching priorities. It serves as a structured index for understanding how Metabase's security posture has evolved, enabling detailed analysis of individual products, vendors, and vulnerability classifications without requiring manual searching across disparate databases.

Vendor: Metabase, Inc.

CVE ID Title CVSS Severity Published
CVE-2026-92813 Metabase through 0.63.18 SSRF via GeoJSON URL validation bypass CWE-918 4.9 Medium 2026-09-16
CVE-2026-86116 Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API CWE-862 6.5 Medium 2026-09-05
CVE-2026-72900 Metabase information exposure CWE-862 6.5 Medium 2026-08-10
CVE-2026-72899 Metabase SQL injection via public card or dashboard CWE-89 10.0 Critical 2026-08-10
CVE-2026-72898 Metabase SQL injection via password reset endpoint CWE-89 10.0 Critical 2026-08-10
CVE-2026-50147 Metabase: Arbitrary File Read via MySQL Connection Property Injection CWE-88 7.6 High 2026-07-15
CVE-2026-50148 Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write CWE-73 10.0 Critical 2026-07-15
CVE-2026-59826 Metabase: Arbitrary Code Execution via Database Connection Detail Bypass CWE-94 9.1 Critical 2026-07-09
CVE-2026-59827 Metabase: Unsafe Deserialization of H2 Query Results CWE-502 9.9 Critical 2026-07-09
CVE-2026-33725 Metabase vulnerable to RCE and Arbitrary File Read via H2 JDBC INIT Injection in EE Serialization Import CWE-502 7.2 High 2026-03-27
CVE-2026-27464 Metabase: Server-Side Template Injection via Notifications Endpoint Leads to RCE CWE-1336 7.7 High 2026-02-21
CVE-2026-22805 Metabase channel test endpoint can reach internal local addresses CWE-918 8.2AI High AI 2026-01-12
CVE-2025-5895 Metabase dom.js parseDataUri redos CWE-1333 4.3 Medium 2025-06-09
CVE-2025-32382 Snowflake credentials logged by the Metabase backend CWE-532 8.1AI High AI 2025-04-10
CVE-2025-30371 Metabase vulnerable to circumvention of local link access protection in GeoJson endpoint CWE-59 6.1 - 2025-03-28
CVE-2025-27141 Metabase Enterprise Edition allows cached questions to leak data to impersonated users CWE-732 4.3 - 2025-02-24
CVE-2024-55951 Metabase sandboxed users could see filter values from other sandboxed users CWE-200 5.0 - 2024-12-16
CVE-2023-37470 Metabase vulnerable to remote code execution via POST /api/setup/validate API endpoint CWE-94 10.0 Critical 2023-08-04
CVE-2023-32680 Missing SQL permissions check in metabase CWE-306 5.8 Medium 2023-05-18
CVE-2023-23629 Metabase subject to Improper Privilege Management CWE-200 6.3 Medium 2023-01-28
CVE-2023-23628 Metabase subject to Exposure of Sensitive Information to an Unauthorized Actor CWE-200 5.7 Medium 2023-01-28
CVE-2022-43776 Metabase 代码问题漏洞 6.5 - 2022-10-26
CVE-2022-39362 Metabase vulnerable to arbitrary SQL execution from queryhash CWE-356 8.8 High 2022-10-26
CVE-2022-39361 Metabase vulnerable to Remote Code Execution via H2 CWE-20 8.8 High 2022-10-26
CVE-2022-39360 Metabase SSO users able to circumvent IdP login by doing password reset CWE-304 6.5 Medium 2022-10-26
CVE-2022-39359 Metabase's GeoJSON validation doesn't prevent redirects to blocked URLs CWE-200 6.5 Medium 2022-10-26
CVE-2022-39358 Metabase vulnerable to circumvention of Locked parameter in Signed Embedding CWE-200 6.5 Medium 2022-10-26
CVE-2022-24853 File system exposure in Metabase CWE-200 5.9 Medium 2022-04-14
CVE-2022-24854 Database bypassing any permissions in Metabase via SQlite attach CWE-610 8.0 High 2022-04-14
CVE-2022-24855 XSS vulnerability in Metabase CWE-79 8.7 High 2022-04-14

All 32 known CVE vulnerabilities affecting Metabase with full Chinese analysis, references, and POCs where available.