CVE-2026-72900 | Medium | 6.5 | 2026-08-10 | Metabase allows an authenticated, low-privileged attacker to read the entire Metabase application database. |
CVE-2026-72899 | Critical | 10.0 | 2026-08-10 | Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter. |
CVE-2026-72898 | Critical | 10.0 | 2026-08-10 | Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the con… |
CVE-2026-50148 | Critical | 10.0 | 2026-07-15 | Metabase is an open-source business intelligence and embedded analytics tool. From 1.54.0 until 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60… |
CVE-2026-50147 | High | 7.6 | 2026-07-15 | Metabase is an open-source business intelligence and embedded analytics tool. From 1.57.0 until 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4, an attacker who can… |
CVE-2026-59827 | Critical | 9.9 | 2026-07-09 | Metabase is an open-source business intelligence and embedded analytics tool. Prior to 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4, Metabase instances with an H2… |
CVE-2026-59826 | Critical | 9.1 | 2026-07-09 | Metabase is an open-source business intelligence and embedded analytics tool. From 1.55.0 until 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2, Metabase did not vali… |
CVE-2026-33725 | High | 7.2 | 2026-03-27 | Metabase is an open source business intelligence and embedded analytics tool. In Metabase Enterprise prior to versions 1.54.22, 1.55.22, 1.56.22, 1.57.16, 1.58… |
CVE-2026-27464 | High | 7.7 | 2026-02-21 | Metabase is an open-source data analytics platform. In versions prior to 0.57.13 and versions 0.58.x through 0.58.6, authenticated users are able to retrieve s… |
CVE-2026-22805 | High | 8.6 | 2026-01-12 | Metabase is an open-source data analytics platform. Prior to 55.13, 56.3, and 57.1, self-hosted Metabase instances that allow users to create subscriptions cou… |
CVE-2025-5895 | Medium | 4.3 | 2025-06-09 | A vulnerability was found in Metabase 54.10. It has been classified as problematic. This affects the function parseDataUri of the file frontend/src/metabase/li… |
CVE-2025-32382 | | | 2025-04-10 | Metabase is an open source Business Intelligence and Embedded Analytics tool. When admins change Snowflake connection details in Metabase (either updating a pa… |
CVE-2025-30371 | | | 2025-03-28 | Metabase is a business intelligence and embedded analytics tool. Versions prior to v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8 are vulnerable to circumvention… |
CVE-2025-27141 | Medium | 6.5 | 2025-02-24 | Metabase Enterprise Edition is the enterprise version of Metabase business intelligence and data analytics software. Starting in version 1.47.0 and prior to ve… |
CVE-2024-55951 | | | 2024-12-16 | Metabase is an open-source data analytics platform. For new sandboxing configurations created in 1.52.0 till 1.52.2.4, sandboxed users are able to see field fi… |
CVE-2023-37470 | Critical | 10.0 | 2023-08-04 | Metabase is an open-source business intelligence and analytics platform. Prior to versions 0.43.7.3, 0.44.7.3, 0.45.4.3, 0.46.6.4, 1.43.7.3, 1.44.7.3, 1.45.4.3… |
CVE-2023-38646 | Critical | 9.8 | 2023-07-21 | Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privi… |
CVE-2023-32680 | Medium | 5.8 | 2023-05-18 | Metabase is an open source business analytics engine. To edit SQL Snippets, Metabase should have required people to be in at least one group with native query… |
CVE-2023-23629 | Medium | 6.3 | 2023-01-28 | Metabase is an open source data analytics platform. Affected versions are subject to Improper Privilege Management. As intended, recipients of dashboards subsc… |
CVE-2023-23628 | Medium | 5.7 | 2023-01-28 | Metabase is an open source data analytics platform. Affected versions are subject to Exposure of Sensitive Information to an Unauthorized Actor. Sandboxed user… |
CVE-2022-39362 | High | 8.8 | 2022-10-26 | Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, unsaved SQL queries are auto-exe… |
CVE-2022-39361 | High | 8.8 | 2022-10-26 | Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, H2 (Sample Database) could allow… |
CVE-2022-39360 | Medium | 6.5 | 2022-10-26 | Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9 single sign on (SSO) users were a… |
CVE-2022-39359 | Medium | 6.5 | 2022-10-26 | Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, custom GeoJSON map URL address w… |
CVE-2022-39358 | Medium | 6.5 | 2022-10-26 | Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, and 1.42.6, it was possible to circumvent locked parameters… |
CVE-2022-43776 | Medium | 6.5 | 2022-10-26 | The url parameter of the /api/geojson endpoint in Metabase versions <44.5 can be used to perform Server Side Request Forgery attacks. Previously implemented bl… |
CVE-2022-24855 | High | 8.7 | 2022-04-14 | Metabase is an open source business intelligence and analytics application. In affected versions Metabase ships with an internal development endpoint `/_intern… |
CVE-2022-24854 | High | 8.0 | 2022-04-14 | Metabase is an open source business intelligence and analytics application. SQLite has an FDW-like feature called `ATTACH DATABASE`, which allows connecting mu… |
CVE-2022-24853 | Medium | 5.9 | 2022-04-14 | Metabase is an open source business intelligence and analytics application. Metabase has a proxy to load arbitrary URLs for JSON maps as part of our GeoJSON su… |
CVE-2021-41277 | Critical | 10.0 | 2021-11-17 | Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->ma… |
CVE-2018-0697 | Medium | 6.1 | 2018-11-15 | Cross-site scripting vulnerability in Metabase version 0.29.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vector… |