← Vulnerability feed

Vulnerability record · CVE-2026-50147 · published 15 July 2026

CVE-2026-50147: Metabase argument injection vulnerability

Metabase · Metabase

Metabase is an open-source business intelligence and embedded analytics tool. From 1.57.0 until 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4, an attacker who can configure a Metabase database connection can read arbitrary files from the Metabase server's filesystem by adding unsafe JDBC parameters to a MySQL or MariaDB connection, causing the driver to read files from the Metabase host and expose the contents through queries against the connected database or through validation error messages. This issue is fixed in versions 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4.

7.6 CVSS 3.1 High EPSS 0.34% · top 75.3% CWE-88 · Argument injection
7.6CVSS 3.1 base score
0.34%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
30 Jul 2026Last modified by NVD

Description

Metabase is an open-source business intelligence and embedded analytics tool. From 1.57.0 until 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4, an attacker who can configure a Metabase database connection can read arbitrary files from the Metabase server's filesystem by adding unsafe JDBC parameters to a MySQL or MariaDB connection, causing the driver to read files from the Metabase host and expose the contents through queries against the connected database or through validation error messages. This issue is fixed in versions 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/metabase/metabase/security/advisories/GHSA-mfpj-crjq-xrcp Vendor Advisory

Track CVE-2026-50147 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2026-72898Metabase unauthenticated SQL injection in reset_password endpointMetabase exposes a database endpoint, '/reset_password', that fails to neutralize attacker-supplied SQL, allowing arbitrary SQL injection. Because th…KEVEPSS 19%analysed7.5CVE-2021-41277Metabase custom GeoJSON map feature allows local file inclusionMetabase does not validate URLs supplied through the custom GeoJSON map setting (admin->settings->maps->custom maps->add a map) before loading them. …KEVEPSS 97%analysed9.8CVE-2023-37470Metabase code injection vulnerabilityMetabase is an open-source business intelligence and analytics platform. Prior to versions 0.43.7.3, 0.44.7.3, 0.45.4.3, 0.46.6.4, 1.43.7.3, 1.44.7.3…EPSS 1.3%9.8CVE-2023-38646Metabase unauthenticated remote command executionMetabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server at the serve…EPSS 99%analysed9.6CVE-2023-32680Metabase missing authentication for critical function vulnerabilityMetabase is an open source business analytics engine. To edit SQL Snippets, Metabase should have required people to be in at least one group with nat…EPSS 0.60%9.1CVE-2026-50148Metabase vulnerabilityMetabase is an open-source business intelligence and embedded analytics tool. From 1.54.0 until 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10,…EPSS 0.77%9.1CVE-2026-59826Metabase code injection vulnerabilityMetabase is an open-source business intelligence and embedded analytics tool. From 1.55.0 until 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2, Metabase di…EPSS 1.0%8.8CVE-2026-59827Metabase deserialization of untrusted data vulnerabilityMetabase is an open-source business intelligence and embedded analytics tool. Prior to 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4, Metabase instances w…EPSS 3.8%

Source: NIST National Vulnerability Database (record CVE-2026-50147), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.