← Vulnerability feed

Vulnerability record · CVE-2022-39362 · published 26 October 2022

CVE-2022-39362: Metabase vulnerability

Metabase · Metabase

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, unsaved SQL queries are auto-executed, which could pose a possible attack vector. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase no longer automatically executes ad-hoc native queries. Now the native editor shows the query and gives the user the option to manually run the query if they want.

8.8 CVSS 3.1 High EPSS 0.86% · top 43.0% CWE-356 · CWE-356
8.8CVSS 3.1 base score
0.86%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, unsaved SQL queries are auto-executed, which could pose a possible attack vector. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase no longer automatically executes ad-hoc native queries. Now the native editor shows the query and gives the user the option to manually run the query if they want.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/metabase/metabase/commit/b7c6bb905a9187347cfc9035443b514713027a5c PatchThird Party Advisory
https://github.com/metabase/metabase/security/advisories/GHSA-93wj-fgjg-r238 Third Party Advisory
https://github.com/metabase/metabase/commit/b7c6bb905a9187347cfc9035443b514713027a5c PatchThird Party Advisory
https://github.com/metabase/metabase/security/advisories/GHSA-93wj-fgjg-r238 Third Party Advisory

Track CVE-2022-39362 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2026-72898Metabase unauthenticated SQL injection in reset_password endpointMetabase exposes a database endpoint, '/reset_password', that fails to neutralize attacker-supplied SQL, allowing arbitrary SQL injection. Because th…KEVEPSS 19%analysed7.5CVE-2021-41277Metabase custom GeoJSON map feature allows local file inclusionMetabase does not validate URLs supplied through the custom GeoJSON map setting (admin->settings->maps->custom maps->add a map) before loading them. …KEVEPSS 97%analysed9.8CVE-2023-37470Metabase code injection vulnerabilityMetabase is an open-source business intelligence and analytics platform. Prior to versions 0.43.7.3, 0.44.7.3, 0.45.4.3, 0.46.6.4, 1.43.7.3, 1.44.7.3…EPSS 1.3%9.8CVE-2023-38646Metabase unauthenticated remote command executionMetabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server at the serve…EPSS 99%analysed9.6CVE-2023-32680Metabase missing authentication for critical function vulnerabilityMetabase is an open source business analytics engine. To edit SQL Snippets, Metabase should have required people to be in at least one group with nat…EPSS 0.60%9.1CVE-2026-50148Metabase vulnerabilityMetabase is an open-source business intelligence and embedded analytics tool. From 1.54.0 until 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10,…EPSS 0.77%9.1CVE-2026-59826Metabase code injection vulnerabilityMetabase is an open-source business intelligence and embedded analytics tool. From 1.55.0 until 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2, Metabase di…EPSS 1.0%8.8CVE-2026-59827Metabase deserialization of untrusted data vulnerabilityMetabase is an open-source business intelligence and embedded analytics tool. Prior to 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4, Metabase instances w…EPSS 3.8%

Source: NIST National Vulnerability Database (record CVE-2022-39362), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.