{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T17:40:31.642Z",
  "tag": {
    "id": "metabase",
    "label": "Metabase",
    "isStack": false,
    "url": "https://pwn.watch/t/metabase",
    "feed": "https://pwn.watch/t/metabase/feed.xml"
  },
  "counts": {
    "incidents": 2,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 2
  },
  "incidents": [
    {
      "slug": "metabase-metabase-cve-2026-72898",
      "title": "Metabase Metabase: Metabase SQL Injection Vulnerability",
      "url": "https://pwn.watch/i/metabase-metabase-cve-2026-72898",
      "json": "https://pwn.watch/i/metabase-metabase-cve-2026-72898.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Metabase Metabase",
      "tags": [
        "metabase",
        "cisa-kev",
        "sql-injection"
      ],
      "cveIds": [
        "CVE-2026-72898"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-08-11",
      "closedAt": "2026-08-11",
      "updatedAt": "2026-08-11",
      "summary": "Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data. Added to CISA KEV on 2026-08-11.",
      "xPost": null
    },
    {
      "slug": "metabase-cve-2021-41277",
      "title": "Metabase GeoJSON API Local File Inclusion",
      "url": "https://pwn.watch/i/metabase-cve-2021-41277",
      "json": "https://pwn.watch/i/metabase-cve-2021-41277.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Metabase",
      "tags": [
        "metabase",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2021-41277"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-11-12",
      "closedAt": "2024-11-12",
      "updatedAt": "2024-11-12",
      "summary": "Metabase contains a local file inclusion vulnerability in the custom map support in the API to read GeoJSON formatted data. Added to the CISA KEV catalog on 2024-11-12. CVE-2021-41277 was assigned before 2024; the KEV listing came in 2024.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "metabase-metabase-cve-2026-72898",
      "incidentTitle": "Metabase Metabase: Metabase SQL Injection Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-08-11",
      "title": "CISA added CVE-2026-72898 to the KEV catalog (due 2026-08-14).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/metabase-metabase-cve-2026-72898"
    },
    {
      "incident": "metabase-cve-2021-41277",
      "incidentTitle": "Metabase GeoJSON API Local File Inclusion",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-11-12",
      "title": "CISA added CVE-2021-41277 to the KEV catalog (federal deadline 2024-12-03)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/metabase-cve-2021-41277"
    }
  ]
}