metabase has 4 CVEs on record between 2021 and 2026. 3 were published in the last 90 days. The median CVSS is 7.9 (high), with 2 rated critical.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 25% vs 1% corpus
- Median CVSS
- 7.9
- Publish → KEV
- —(1)
- Last 90 days
- 3 prev 0
Worst active — by depth score
CVE-2021-41277Critical· 10.0Metabase is an open source data analytics platform99CVE-2026-103928Critical· 9.3Metabase is an open source business intelligence and analytics platform51CVE-2026-86116Medium· 6.5Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries48CVE-2026-92813Medium· 4.9Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing unauthenticated attackers to reach loopback services39
metabase vulnerabilities
CVEs affecting metabase, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-103928Critical· 9.3Metabase is an open source business intelligence and analytics platform
Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and actions against an H2 data source are passed through without restricting host-facing buil…
CVE-2026-92813Medium· 4.9PoCMetabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing unauthenticated attackers to reach loopback services
Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing unauthenticated attackers to reach loopback services. Attackers can save a malicious GeoJSON entry with 0.0.0.0 and trig…
CVE-2026-86116Medium· 6.5PoCMetabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries
Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DEL…
CVE-2021-41277Critical· 10.0CISA KEVPoCMetabase is an open source data analytics platform
Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (inclu…