Metabase

5 known vulnerabilities in Metabase, 2 critical, 2 actively exploited, with patch priority, exploit likelihood and the news covering them.

Recently exploited

  • CVE-2026-72898 CVSS 10.0 critical · actively exploited Metabase SQL Injection Vulnerability
  • CVE-2021-41277 CVSS 7.5 high · actively exploited Metabase GeoJSON API Local File Inclusion Vulnerability

Latest vulnerabilities

  • CVE-2026-92813 CVSS 6.9 medium Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing unauthenticated…
  • CVE-2026-86116 CVSS 7.1 high Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user…
  • CVE-2026-72899 CVSS 10.0 critical Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter…
  • CVE-2026-72898 CVSS 10.0 critical · actively exploited Metabase SQL Injection Vulnerability
  • CVE-2021-41277 CVSS 7.5 high · actively exploited Metabase GeoJSON API Local File Inclusion Vulnerability