Metabase 2

Organization

CVE-2026-72898: Metabase SQL Injection Vulnerability

Known Exploited Vulnerabilities CISA KEV Catalog Aug 11, 2026

Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change...

Vulnerabilities & Patching

CVE-2021-41277: Metabase GeoJSON API Local File Inclusion Vulnerability

Known Exploited Vulnerabilities CISA KEV Catalog Nov 12, 2024

Metabase contains a local file inclusion vulnerability in the custom map support in the API to read GeoJSON formatted data.

Vulnerabilities & Patching