CVE-2026-50148: Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write

Critical severity · published Jul 15, 2026

CVE-2026-50148

Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write

9.1

CVSS

0.8%

EPSS

On KEV

Description

Metabase is an open-source business intelligence and embedded analytics tool. From 1.54.0 until 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4, a Metabase user with permission to add or edit a database connection can achieve remote code execution on the Metabase server by configuring a Snowflake connection to an attacker-controlled server, because a flaw in the Snowflake JDBC driver can write arbitrary files anywhere on the Metabase host, including replacing one of Metabase's own database driver files that later executes inside the Metabase process. This issue is fixed in versions 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

High

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)0.8% · higher than 55% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

metabase · metabase

>= 1.54.0, < 1.54.24; >= 1.55.0, < 1.55.24; >= 1.56.0, < 1.56.25; >= 1.57.0, < 1.57.19; >= 1.58.0, < 1.58.14; >= 1.59.0, < 1.59.10; +1 more · source: vendor, NVD

Affected product

metabase

All metabase CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-50148

CVE.org

https://www.cve.org/CVERecord?id=CVE-2026-50148

Vendor Advisory

https://github.com/metabase/metabase/security/advisories/GHSA-r6x2-rchx-q9g9