CVE-2026-50148
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
A vulnerability in Metabase allows a user with permission to add or edit database connections to achieve remote code execution on the Metabase server. It exploits a flaw in the Snowflake JDBC driver that can write arbitrary files anywhere on the host, including replacing Metabase's own database driver files that later execute inside the Metabase process.
Risk Assessment
An attacker can take control of the Metabase server, leading to breach of data confidentiality, integrity, and availability, and potential lateral movement within the infrastructure.
Recommendation
Immediately upgrade Metabase to one of the patched versions: 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, or 1.60.4. Restrict database connection configuration permissions to trusted users only.
Original NVD description (English source)
Metabase is an open-source business intelligence and embedded analytics tool. From 1.54.0 until 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4, a Metabase user with permission to add or edit a database connection can achieve remote code execution on the Metabase server by configuring a Snowflake connection to an attacker-controlled server, because a flaw in the Snowflake JDBC driver can write arbitrary files anywhere on the Metabase host, including replacing one of Metabase's own database driver files that later executes inside the Metabase process. This issue is fixed in versions 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4.