Vulnerability in Metabase
CVE-2026-50147
Metabase is an open-source business intelligence and embedded analytics tool. From 1.57.0 until 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4, an attacker who can configure a Metabase database connection can read arbitrary files from the Metabase server's filesystem by adding unsafe JDBC parameters to a MySQL or MariaDB connection, causing the driver to read files from the Metabase host and expose the contents through queries against the connected database or through validation error messages. This issue is fixed in versions 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4.
EPSS: 0.003 (26.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N.
Affected products
- Metabase — versions >= 1.57.0, < 1.57.19.1, >= 1.58.0, < 1.58.14.1, >= 1.59.0, < 1.59.10
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-50147?
- CVE-2026-50147 is a high-severity vulnerability in Metabase, classified under Argument Injection. CVSS score: 7.6/10. Published 2026-07-15.
- How severe is CVE-2026-50147?
- High severity. CVSS v3 base score is 7.6 out of 10.