Vulnerability details

CVE-2026-27464

metabase metabase

Metabase: Server-Side Template Injection via Notifications Endpoint Leads to RCE

CVSS 3.1

7.7High

Official description

Metabase is an open-source data analytics platform. In versions prior to 0.57.13 and versions 0.58.x through 0.58.6, authenticated users are able to retrieve sensitive information from a Metabase instance, including database access credentials. During testing, it was confirmed that a low-privileged user can extract sensitive information including database credentials, into the email body via template evaluation. This issue has been fixed in versions 0.57.13 and 0.58.7. To workaround this issue, users can disable notifications in their Metabase instance to disallow access to the vulnerable endpoints.

CVSS scores

Score	Version	Source	Vector
7.7High	3.1	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N`

Affected products

Vendor	Product	Versions	Source
metabase	metabase	< 0.57.13	CVEProject cvelistV5 (CNA)
metabase	metabase	>= 0.58.x, < 0.58.7	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/metabase/metabase/security/advisories/GHSA-vcj8-rcm8-gfj9 x_refsource_CONFIRM
https://github.com/metabase/metabase/releases/tag/v0.57.13 x_refsource_MISC
https://github.com/metabase/metabase/releases/tag/v0.58.7 x_refsource_MISC

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-02-21
Last updated: 2026-02-24
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.29%

Probability of exploitation in 30 days

22.6%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Partial

Weaknesses (CWE)

CWE-1336
Improper Neutralization of Special Elements Used in a Template Engine
CWE-94
Improper Control of Generation of Code ('Code Injection')