CVE-2026-50147
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Metabase from version 1.57.0 to 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4 contains a vulnerability that allows an attacker with access to database connection configuration to read arbitrary files from the Metabase server's filesystem. By adding unsafe JDBC parameters to a MySQL or MariaDB connection, the driver can read files from the Metabase host and expose their contents through queries or validation error messages.
Risk Assessment
The risk involves potential leakage of sensitive data such as configuration files, private keys, or credentials stored on the Metabase server, which could lead to further privilege escalation or compromise of the entire infrastructure.
Recommendation
Immediately update Metabase to version 1.57.19.1, 1.58.14.1, 1.59.10, or 1.60.4, depending on the release branch used. Additionally, restrict access to database connection configuration to trusted users only.
Other vulnerabilities in Metabase
See all- CVE-2026-72899Critical
Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter.
- CVE-2026-72898CriticalActively exploited
Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.
- CVE-2026-50148Critical
A vulnerability in Metabase allows a user with permission to add or edit database connections to achieve remote code execution on the Metabase server. It exploits a flaw in the Snowflake JDBC driver that can write arbitrary files anywhere on the host, including replacing Metabase's own database driver files that later execute inside the Metabase process.
- CVE-2026-59827Critical
Metabase prior to versions 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4 deserializes arbitrary Java objects returned in OTHER type columns from H2 native queries without validation. An authenticated user able to run native H2 queries can execute code on the Metabase server.
- CVE-2026-59826Critical
Metabase, an open-source business intelligence tool, contains a vulnerability allowing an authenticated administrator to execute arbitrary Java code on the server by registering a crafted H2 database connection. The issue affects versions from 1.55.0 up to 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2.
- CVE-2026-72900Medium
Metabase allows an authenticated, low-privileged attacker to read the entire Metabase application database.
Original NVD description (English source)
Metabase is an open-source business intelligence and embedded analytics tool. From 1.57.0 until 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4, an attacker who can configure a Metabase database connection can read arbitrary files from the Metabase server's filesystem by adding unsafe JDBC parameters to a MySQL or MariaDB connection, causing the driver to read files from the Metabase host and expose the contents through queries against the connected database or through validation error messages. This issue is fixed in versions 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4.