Login Request a demo
ME
Product
metabase
by metabase · last CVE Oct 13, 2026
On CISA KEVExploited in the wild
31
CVEs
2
On KEV
10.0
Max CVSS
1
New 30D
Vulnerabilities31In the news2Timeline
Severity mix
Critical 8High 9Medium 14Low 0
Severity
All severities31Critical8High9Medium14Low0
Exploitation
On CISA KEV2Exploited in the wild2
Watch

Add metabase to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-72898
In wildKEV
10.0
99%
Aug 10
Metabase SQL injection via password reset endpoint
Affected: x.58.0 before x.58.24; x.59.0 before x.59.21; x.60.0 before x.60.17; x.61.0 before x.61.11; x.62.0 before x.62.9; x.63.0 before x.63.5
CVE-2021-41277
In wildKEV
7.5
97%
Nov 17
GeoJSON URL validation can expose server files and environment variables to unauthorized users
Affected: < 0.40.5; >= 1.0.0, < 1.40.5
CVE-2026-72899
10.0
1%
Aug 10
Metabase SQL injection via public card or dashboard
Affected: x.58.0 before x.58.24; x.59.0 before x.59.21; x.60.0 before x.60.17; x.61.0 before x.61.11; x.62.0 before x.62.9; x.63.0 before x.63.5
CVE-2023-37470
9.8
1%
Aug 4
Metabase is an open-source business intelligence and analytics platform
Affected: before 0.43.7.3; before 1.43.7.3; 0.44.0 before 0.44.7.3; 0.45.0 before 0.45.4.3; 0.46.0 before 0.46.6.4; 1.44.0 before 1.44.7.3; +2 more
CVE-2023-38646
9.8
99%
Jul 21
Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level
Affected: before 0.43.7.2; before 1.43.7.2; 0.44.0 before 0.44.7.1; 0.45.0 before 0.45.4.1; 0.46.0 before 0.46.6.1; 1.44.0 before 1.44.7.1; +2 more
CVE-2023-32680
9.6
1%
May 18
Metabase is an open source business analytics engine
Affected: before 0.44.7; 0.45.0 before 0.45.4; 0.46.0 before 0.46.3; 1.0.0 before 1.44.7; 1.45.0 before 1.45.4; 1.46.0 before 1.46.3
CVE-2026-103928
9.3
0%
Oct 13
Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions
Affected: >= 1.55.0, < 1.58.16; >= 1.59.0, < 1.59.13; >= 1.60.0, < 1.60.9; >= 1.61.0, < 1.61.4; >= 0.55.0, < 0.58.15.3; >= 0.59.0, < 0.59.12.1; +2 more
CVE-2026-50148
9.1
1%
Jul 15
Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write
Affected: >= 1.54.0, < 1.54.24; >= 1.55.0, < 1.55.24; >= 1.56.0, < 1.56.25; >= 1.57.0, < 1.57.19; >= 1.58.0, < 1.58.14; >= 1.59.0, < 1.59.10; +1 more
CVE-2026-59826
9.1
1%
Jul 9
Metabase: Arbitrary Code Execution via Database Connection Detail Bypass
Affected: >= 1.55.0, < 1.58.15.1; >= 1.59.0, < 1.59.12; >= 1.60.0, < 1.60.6.3; >= 1.61.0, < 1.61.2
CVE-2026-59827
8.8
4%
Jul 9
Metabase: Unsafe Deserialization of H2 Query Results
Affected: >= 1.58.0, < 1.58.15; >= 1.59.0, < 1.59.12; >= 1.60.0, < 1.60.6.3; >= 1.61.0, < 1.61.1.4
CVE-2022-39361
8.8
1%
Oct 26
Metabase vulnerable to Remote Code Execution via H2
Affected: < 0.41.9; >= 0.42.0, < 0.42.6; >= 0.43.0, < 0.43.7; >= 0.44.0, < 0.44.5; >= 1.0.0, < 1.41.9; >= 1.42.0, < 1.42.6; +2 more
CVE-2022-39362
8.8
1%
Oct 26
Metabase vulnerable to arbitrary SQL execution from queryhash
Affected: < 0.41.9; >= 0.42.0, < 0.42.6; >= 0.43.0, < 0.43.7; >= 0.44.0, < 0.44.5; >= 1.0.0, < 1.41.9; >= 1.42.0, < 1.42.6; +2 more
CVE-2022-24854
8.8
1%
Apr 14
Metabase is an open source business intelligence and analytics application
Affected: 0.41.0 before 0.41.7; 0.42.0 before 0.42.4; 1.41.0 before 1.41.7; 1.42.0 before 1.42.4
CVE-2026-22805
8.6
0%
Jan 12
Metabase is an open-source data analytics platform
Affected: before 0.55.13; before 1.55.13; 0.56.0 before 0.56.3; 1.56.0 before 1.56.3; 0.57.0; 1.57.0
CVE-2026-50147
7.6
0%
Jul 15
Metabase: Arbitrary File Read via MySQL Connection Property Injection
Affected: >= 1.57.0, < 1.57.19.1; >= 1.58.0, < 1.58.14.1; >= 1.59.0, < 1.59.10; >= 1.60.0, < 1.60.4
CVE-2025-5895
7.5
1%
Jun 9
A vulnerability was found in Metabase 54.10
Affected: 0.54.10
CVE-2026-33725
7.2
1%
Mar 27
Metabase is an open source business intelligence and embedded analytics tool
Affected: before 1.54.22; 1.55.0 before 1.55.22; 1.56.0 before 1.56.22; 1.57.0 before 1.57.16; 1.58.0 before 1.58.10; 1.59.0 before 1.59.4
CVE-2026-86116
6.5
0%
Sep 5
Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API
Affected: 0.57.0 before 0.63.1
CVE-2026-72900
6.5
0%
Aug 10
Metabase information exposure
Affected: x.58.0 before x.58.24; x.59.0 before x.59.21; x.60.0 before x.60.17; x.61.0 before x.61.11; x.62.0 before x.62.9; x.63.0 before x.63.5
CVE-2026-27464
6.5
0%
Feb 21
Metabase is an open-source data analytics platform
Affected: before 0.57.13; before 1.57.13; 0.58.0 before 0.58.7; 1.58.0 before 1.58.7
CVE-2025-27141
6.5
0%
Feb 24
Metabase Enterprise Edition is the enterprise version of Metabase business intelligence and data analytics software
Affected: 1.47.0 before 1.50.36; 1.51.0 before 1.51.14; 1.52.0 before 1.52.11; 1.53.0 before 1.53.2
CVE-2022-43776
6.5
1%
Oct 26
The url parameter of the /api/geojson endpoint in Metabase versions <44.5 can be used to perform Server Side Request Forgery attacks
Affected: before 0.44.5
CVE-2022-39358
6.5
1%
Oct 26
Metabase vulnerable to circumvention of Locked parameter in Signed Embedding
Affected: < 0.42.6; >= 0.43.0, < 0.43.7; >= 0.44.0, < 0.44.5; >= 1.0.0, < 1.42.6; >= 1.43.0, < 1.43.7; >= 1.44.0, < 1.44.5
CVE-2022-39359
6.5
1%
Oct 26
Metabase's GeoJSON validation doesn't prevent redirects to blocked URLs
Affected: < 0.41.9; >= 0.42.0, < 0.42.6; >= 0.43.0, < 0.43.7; >= 0.44.0, < 0.44.5; >= 1.0.0, < 1.41.9; >= 1.42.0, < 1.42.6; +2 more
CVE-2022-39360
6.5
1%
Oct 26
Metabase SSO users able to circumvent IdP login by doing password reset
Affected: < 0.41.9; >= 0.42.0, < 0.42.6; >= 0.43.0, < 0.43.7; >= 0.44.0, < 0.44.5; >= 1.0.0, < 1.41.9; >= 1.42.0, < 1.42.6; +2 more
CVE-2023-23629
6.3
0%
Jan 28
Metabase is an open source data analytics platform
Affected: before 0.43.7.1; 0.44.0 before 0.44.6.1; 0.45.0 before 0.45.2.1; 1.0.0 before 1.43.7.1; 1.44.0 before 1.44.6.1; 1.45.0 before 1.45.2.1
CVE-2018-0697
6.1
1%
Nov 15
Cross-site scripting vulnerability in Metabase version 0.29.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors
Affected: through 0.29.3
CVE-2022-24855
5.4
1%
Apr 14
Metabase is an open source business intelligence and analytics application
Affected: 0.40.0 before 0.40.8; 0.41.0 before 0.41.7; 0.42.0 before 0.42.4; 1.40.0 before 1.40.8; 1.41.0 before 1.41.7; 1.42.0 before 1.42.4
CVE-2022-24853
5.3
3%
Apr 14
Metabase is an open source business intelligence and analytics application
Affected: 0.40.0 before 0.40.8; 0.41.0 before 0.41.7; 0.42.0 before 0.42.4; 1.40.0 before 1.40.8; 1.41.0 before 1.41.7; 1.42.0 before 1.42.4
CVE-2026-92813
4.9
0%
Sep 16
Metabase through 0.63.18 SSRF via GeoJSON URL validation bypass
Affected: through 0.63.18
CVE-2023-23628
4.1
0%
Jan 28
Metabase is an open source data analytics platform
Affected: before 0.43.7.1; 0.44.0 before 0.44.6.1; 0.45.0 before 0.45.2.1; 1.0.0 before 1.43.7.1; 1.44.0 before 1.44.6.1; 1.45.0 before 1.45.2.1
Showing 31