Vendor

    Metabase

    34 known vulnerabilities in products by Metabase, 2 of them actively exploited (CISA KEV).

    Key figures

    34

    Vulnerabilities

    2

    Actively exploited (KEV)

    0

    Used by ransomware

    10

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Metabase
    CriticalCVE-2026-72898

    Metabase SQL injection via password reset endpoint

    In CISA KEV

    		10.0
    CriticalCVE-2021-41277

    GeoJSON URL validation can expose server files and environment variables to unauthorized users

    In CISA KEV

    		10.0
    CriticalCVE-2026-59827

    Metabase: Unsafe Deserialization of H2 Query Results

    		9.9
    CriticalCVE-2023-38646

    Metabase: security vulnerability

    		9.8
    CriticalCVE-2026-72899

    Metabase SQL injection via public card or dashboard

    		10.0
    CriticalCVE-2026-59826

    Metabase: Arbitrary Code Execution via Database Connection Detail Bypass

    		9.1
    CriticalCVE-2026-50148

    Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write

    		10.0
    CriticalCVE-2023-37470

    Metabase vulnerable to remote code execution via POST /api/setup/validate API endpoint

    		10.0
    MediumCVE-2022-24853

    File system exposure in Metabase

    		5.9
    CriticalCVE-2026-103928

    Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions

    		—
    HighCVE-2022-39361

    Metabase vulnerable to Remote Code Execution via H2

    		8.8
    HighCVE-2022-39362

    Metabase vulnerable to arbitrary SQL execution from queryhash

    		8.8
    HighCVE-2026-33725

    Metabase: Deserialization of Untrusted Data

    		7.2
    MediumCVE-2026-92813

    Metabase through 0.63.18 SSRF via GeoJSON URL validation bypass

    		4.9
    HighCVE-2022-24854

    Database bypassing any permissions in Metabase via SQlite attach

    		8.0
    HighCVE-2026-86116

    Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API

    		6.5
    HighCVE-2026-72900

    Metabase information exposure

    		6.5
    HighCVE-2022-24855

    XSS vulnerability in Metabase

    		8.7
    HighCVE-2026-50147

    Metabase: Arbitrary File Read via MySQL Connection Property Injection

    		7.6
    MediumCVE-2022-43776

    Metabase: Server-Side Request Forgery (SSRF)

    		6.5
    HighCVE-2026-22805

    Metabase channel test endpoint can reach internal local addresses

    		8.6
    MediumCVE-2022-39359

    Metabase's GeoJSON validation doesn't prevent redirects to blocked URLs

    		6.5
    MediumCVE-2018-0697

    Metabase: Cross-Site Scripting (XSS)

    		6.1
    HighCVE-2026-27464

    Metabase: Server-Side Template Injection via Notifications Endpoint Leads to RCE

    		7.7
    HighCVE-2025-5895

    Metabase dom.js parseDataUri redos

    		4.3

    All vulnerabilities in search

    News

    Products

    Products by Metabase
    Metabase342