Metabase

Security incidents tagged Metabase. Newest first.

Show 2 older incidents

Aug 11HighMetabase Metabase: Metabase SQL Injection VulnerabilityPatched
Metabase Metabase Patched
Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data. Added to CISA KEV on 2026-08-11.
Open incident →CVE-2026-72898

Nov 12CriticalMetabase GeoJSON API Local File InclusionPatched
Metabase Patched
Metabase contains a local file inclusion vulnerability in the custom map support in the API to read GeoJSON formatted data. Added to the CISA KEV catalog on 2024-11-12. CVE-2021-41277 was assigned before 2024; the KEV listing came in 2024.
Open incident →CVE-2021-41277

1 Metabase incident in the last 12 months

Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore