VULNERABILITY INTELLIGENCE

CVE-2026-50147

CVSS score7.6 HIGH
EPSS probability0.34%
CISA KEVNot currently listed
Published2026-07-15
Last modified2026-07-30
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

Description

Metabase is an open-source business intelligence and embedded analytics tool. From 1.57.0 until 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4, an attacker who can configure a Metabase database connection can read arbitrary files from the Metabase server's filesystem by adding unsafe JDBC parameters to a MySQL or MariaDB connection, causing the driver to read files from the Metabase host and expose the contents through queries against the connected database or through validation error messages. This issue is fixed in versions 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4.

Weakness classification

  • security-advisories@github.com: CWE-88

Primary references