https://pwn.watch/t/metabase Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Tue, 11 Aug 2026 00:00:00 GMT https://pwn.watch/i/metabase-metabase-cve-2026-72898 https://pwn.watch/i/metabase-metabase-cve-2026-72898 Tue, 11 Aug 2026 00:00:00 GMT high <p>Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data. Added to CISA KEV on 2026-08-11.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2026-08-11: CISA added CVE-2026-72898 to the KEV catalog (due 2026-08-14).</li></ul> <p><strong>CVEs:</strong> CVE-2026-72898</p> https://pwn.watch/i/metabase-cve-2021-41277 https://pwn.watch/i/metabase-cve-2021-41277 Tue, 12 Nov 2024 00:00:00 GMT critical <p>Metabase contains a local file inclusion vulnerability in the custom map support in the API to read GeoJSON formatted data. Added to the CISA KEV catalog on 2024-11-12. CVE-2021-41277 was assigned before 2024; the KEV listing came in 2024.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2024-11-12: CISA added CVE-2021-41277 to the KEV catalog (federal deadline 2024-12-03) (<a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2021-41277</p>