metabase vulnerabilities

30 published CVEs name metabase among the affected products; CISA lists 2 of them as exploited in the wild.

Critical 8High 9Medium 10Low 3Not scored 0

CVEs per yearBy the year they were published

CVE-2026-72898
Metabase SQL injection via password reset endpoint
Metabase · Metabase
ExploitedCritical10.0
CVE-2021-41277
GeoJSON URL validation can expose server files and environment variables to unauthorized users
metabase · metabase
ExploitedCritical10.0

CVE-2026-103928
Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions
metabase · metabase
Critical9.3
CVE-2026-92813
Metabase through 0.63.18 SSRF via GeoJSON URL validation bypass
metabase · Metabase
Medium6.9
CVE-2026-86116
Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API
metabase · metabase
High7.1
CVE-2026-72900
Metabase information exposure
Metabase · Metabase
High7.1
CVE-2026-72899
Metabase SQL injection via public card or dashboard
Metabase · Metabase
Critical10.0
CVE-2026-72898
Metabase SQL injection via password reset endpoint
Metabase · Metabase
ExploitedCritical10.0
CVE-2026-50147
Metabase: Arbitrary File Read via MySQL Connection Property Injection
metabase · metabase
High7.6
CVE-2026-50148
Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write
metabase · metabase
Critical10.0
CVE-2026-59826
Metabase: Arbitrary Code Execution via Database Connection Detail Bypass
metabase · metabase
Critical9.1
CVE-2026-59827
Metabase: Unsafe Deserialization of H2 Query Results
metabase · metabase
Critical9.9