CVE-2026-50148 – Metabase
“Database connection privileges can become a direct path to server compromise and sensitive file exposure.”
Metabase has released updates addressing two vulnerabilities in its database connection functionality. A user permitted to configure database connections could exploit unsafe JDBC behavior to execute code or read arbitrary files from the Metabase server. The fixes restrict dangerous connection parameters and prevent attacker-controlled Snowflake infrastructure from writing files to the host.
CVE-2026-50148 has a CVSS score of 10.0, Critical severity. The vulnerability could enable remote code execution by replacing a Metabase database driver file that is later loaded by the application. CVE-2026-50147 has a CVSS score of 7.6, High severity. It could expose arbitrary server files through malicious MySQL or MariaDB JDBC parameters. Fixed releases include Metabase 1.54.24, 1.55.24, 1.56.25, 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4, depending on the affected release branch.
Key Details
- Affected Product
- Metabase Metabase
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-73