CVE-2026-50147

Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and actions against an H2 data source are passed through without restricting host-facing built-in functions. A user authorized to run native queries or actions can invoke FILE_READ, FILE_WRITE, CSVREAD, CSVWRITE, or LINK_SCHEMA to read or write arbitrary files on the Metabase server or link other databases. The default sample database uses H2, so the vulnerable surface is exposed by default.

Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter.

A vulnerability in Metabase allows a user with permission to add or edit database connections to achieve remote code execution on the Metabase server. It exploits a flaw in the Snowflake JDBC driver that can write arbitrary files anywhere on the host, including replacing Metabase's own database driver files that later execute inside the Metabase process.

Metabase prior to versions 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4 deserializes arbitrary Java objects returned in OTHER type columns from H2 native queries without validation. An authenticated user able to run native H2 queries can execute code on the Metabase server.

Metabase, an open-source business intelligence tool, contains a vulnerability allowing an authenticated administrator to execute arbitrary Java code on the server by registering a crafted H2 database connection. The issue affects versions from 1.55.0 up to 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2.

Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing unauthenticated attackers to reach loopback services. Attackers can save a malicious GeoJSON entry with 0.0.0.0 and trigger requests that return loopback service responses to unauthenticated callers.

Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business glossary data without proper authorization.

Metabase allows an authenticated, low-privileged attacker to read the entire Metabase application database.