Vulnerability details
CVE-2026-50147
metabase metabase
Metabase: Arbitrary File Read via MySQL Connection Property Injection
CVSS 3.1
7.6High
Official description
Metabase is an open-source business intelligence and embedded analytics tool. From 1.57.0 until 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4, an attacker who can configure a Metabase database connection can read arbitrary files from the Metabase server's filesystem by adding unsafe JDBC parameters to a MySQL or MariaDB connection, causing the driver to read files from the Metabase host and expose the contents through queries against the connected database or through validation error messages. This issue is fixed in versions 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.6High | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| metabase | metabase | >= 1.57.0, < 1.57.19.1 | CVEProject cvelistV5 (CNA) |
| metabase | metabase | >= 1.58.0, < 1.58.14.1 | CVEProject cvelistV5 (CNA) |
| metabase | metabase | >= 1.59.0, < 1.59.10 | CVEProject cvelistV5 (CNA) |
| metabase | metabase | >= 1.60.0, < 1.60.4 | CVEProject cvelistV5 (CNA) |
References and advisories
1- https://github.com/metabase/metabase/security/advisories/GHSA-mfpj-crjq-xrcp x_refsource_CONFIRM
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-07-15
- Last updated
- 2026-07-15
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.33%
Probability of exploitation in 30 days
27.4%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')