What is CVE-2026-22805?

CVE-2026-22805 is a high-severity vulnerability in Metabase, classified under Server-Side Request Forgery (SSRF). CVSS score: 8.6/10. Published 2026-01-12.

How severe is CVE-2026-22805?

High severity. CVSS v3 base score is 8.6 out of 10.

SSRF in Metabase

CVE-2026-22805

Metabase is an open-source data analytics platform. Prior to 55.13, 56.3, and 57.1, self-hosted Metabase instances that allow users to create subscriptions could be potentially impacted if their Metabase is colocated with other unsecured resources. This vulnerability is fixed in 55.13, 56.3, and 57.1.

Vulnerability class: SSRF (Server-Side Request Forgery)

EPSS: 0.002 (10.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N.

Affected products

Metabase — versions 0.57.0, >= 0.56.0-beta, < 56.3, >= 0.57.0-beta, < 57.1

Weakness classification (CWE)

CWE-918 — Server-Side Request Forgery (SSRF)

References

security-advisories@github.com (x_refsource_CONFIRM, Mitigation, Vendor Advisory)

Frequently asked questions

What is CVE-2026-22805?: CVE-2026-22805 is a high-severity vulnerability in Metabase, classified under Server-Side Request Forgery (SSRF). CVSS score: 8.6/10. Published 2026-01-12.
How severe is CVE-2026-22805?: High severity. CVSS v3 base score is 8.6 out of 10.