Ramas de versiones afectadas
- 1.63 1 CVE KEV 1
- 1.62 1 CVE KEV 1
- 1.61 3 CVE KEV 1
- 1.60 5 CVE KEV 1
- 1.59 6 CVE KEV 1
- 1.58 7 CVE KEV 1
- 1.57 6 CVE
- 1.56 5 CVE
- 1.55 5 CVE
- 1.54 4 CVE
- 1.53 4 CVE
- 1.52 4 CVE
- 1.51 4 CVE
- 1.50 4 CVE
- 1.47 4 CVE
- 1.46 6 CVE
- 1.45 8 CVE
- 1.44 13 CVE
- 1.43 13 CVE
- 1.42 16 CVE
- 1.41 15 CVE
- 1.40 11 CVE KEV 1
- 1.0 8 CVE
- 0.63 8 CVE KEV 1
- 0.62 8 CVE KEV 1
- 0.61 9 CVE KEV 1
- 0.60 9 CVE KEV 1
- 0.59 9 CVE KEV 1
- 0.58 9 CVE KEV 1
- 0.57 7 CVE
- 0.56 6 CVE
- 0.55 6 CVE
- 0.54 7 CVE
- 0.46 7 CVE
- 0.45 9 CVE
- 0.44 15 CVE
- 0.43 15 CVE
- 0.42 18 CVE
- 0.41 17 CVE
- 0.40 13 CVE KEV 1
- 0.29 11 CVE
Vulnerabilidades conocidas
| CVE | Título | Versiones afectadas | CVSS | Explotada | EPSS | Publicación |
|---|---|---|---|---|---|---|
| CVE-2026-72898 | Metabase SQL injection via password reset endpoint | ≥ x.58.0 < x.58.24 ≥ x.59.0 < x.59.21 ≥ x.60.0 < x.60.17 | 10.0 | KEV | 98.2% | 2026-08-10 |
| CVE-2021-41277 | GeoJSON URL validation can expose server files and environment variables to unauthorized users | * = 0.40.0 = 0.40.1 | 7.5 | KEV | 97.2% | 2021-11-17 |
| CVE-2026-103928 | Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions | * | 9.3 | — | 2026-10-14 | |
| CVE-2026-92813 | Metabase through 0.63.18 SSRF via GeoJSON URL validation bypass | ≤ 0.63.18 | 6.9 | — | 2026-09-17 | |
| CVE-2026-86116 | Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API | ≥ 0.57.0 < 0.63.1 | 7.1 | — | 2026-09-05 | |
| CVE-2026-72900 | Metabase information exposure | ≥ x.58.0 < x.58.24 ≥ x.59.0 < x.59.21 ≥ x.60.0 < x.60.17 | 7.1 | — | 2026-08-11 | |
| CVE-2026-72899 | Metabase SQL injection via public card or dashboard | ≥ x.58.0 < x.58.24 ≥ x.59.0 < x.59.21 ≥ x.60.0 < x.60.17 | 10.0 | — | 2026-08-11 | |
| CVE-2026-50148 | Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write | * ≥ 1.54.0 < 1.54.24 ≥ 1.55.0 < 1.55.24 | 9.1 | — | 2026-07-15 | |
| CVE-2026-50147 | Metabase: Arbitrary File Read via MySQL Connection Property Injection | * ≥ 1.57.0 < 1.57.19.1 ≥ 1.58.0 < 1.58.14.1 | 7.6 | — | 2026-07-15 | |
| CVE-2026-59826 | Metabase: Arbitrary Code Execution via Database Connection Detail Bypass | * ≥ 1.55.0 < 1.58.15.1 ≥ 1.59.0 < 1.59.12 | 9.1 | — | 2026-07-09 | |
| CVE-2026-59827 | Metabase: Unsafe Deserialization of H2 Query Results | * ≥ 0.58.0 < 0.58.15 ≥ 0.59.0 < 0.59.12 | 8.8 | — | 2026-07-09 | |
| CVE-2026-33725 | Metabase vulnerable to RCE and Arbitrary File Read via H2 JDBC INIT Injection in EE Serialization Import | * < 1.54.22 ≥ 1.55.0 < 1.55.22 | 7.2 | — | 2026-03-27 | |
| CVE-2026-27464 | Metabase: Server-Side Template Injection via Notifications Endpoint Leads to RCE | * < 0.57.13 < 1.57.13 | 6.5 | — | 2026-02-21 | |
| CVE-2026-22805 | Metabase channel test endpoint can reach internal local addresses | * < 0.55.13 < 1.55.13 | 2.1 | — | 2026-01-12 | |
| CVE-2025-5895 | Metabase dom.js parseDataUri redos | = 0.54.10 | 2.1 | — | 2025-06-09 | |
| CVE-2025-32382 | Snowflake credentials logged by the Metabase backend | * | 1.8 | — | 2025-04-10 | |
| CVE-2025-30371 | Metabase vulnerable to circumvention of local link access protection in GeoJson endpoint | * | 2.1 | — | 2025-03-28 | |
| CVE-2025-27141 | Metabase Enterprise Edition allows cached questions to leak data to impersonated users | * ≥ 1.47.0 < 1.50.36 ≥ 1.51.0 < 1.51.14 | 4.8 | — | 2025-02-24 | |
| CVE-2024-55951 | Metabase sandboxed users could see filter values from other sandboxed users | * | 4.8 | — | 2024-12-17 | |
| CVE-2023-37470 | Metabase vulnerable to remote code execution via POST /api/setup/validate API endpoint | * < 0.43.7.3 < 1.43.7.3 | 9.8 | — | 2023-08-04 | |
| CVE-2023-38646 | Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitr... | * < 0.43.7.2 < 1.43.7.2 | 9.8 | — | 2023-07-21 | |
| CVE-2023-32680 | Missing SQL permissions check in metabase | * < 0.44.7 ≥ 0.45.0 < 0.45.4 | 9.6 | — | 2023-05-18 | |
| CVE-2023-23628 | Metabase subject to Exposure of Sensitive Information to an Unauthorized Actor | * < 0.43.7.1 ≥ 0.44.0 < 0.44.6.1 | 4.1 | — | 2023-01-28 | |
| CVE-2023-23629 | Metabase subject to Improper Privilege Management | * < 0.43.7.1 ≥ 0.44.0 < 0.44.6.1 | 6.3 | — | 2023-01-28 | |
| CVE-2022-39362 | Metabase vulnerable to arbitrary SQL execution from queryhash | * ≥ 0.41.0 < 0.41.9 ≥ 0.42.0 < 0.42.6 | 8.8 | — | 2022-10-26 | |
| CVE-2022-39361 | Metabase vulnerable to Remote Code Execution via H2 | * ≥ 0.41.0 < 0.41.9 ≥ 0.42.0 < 0.42.6 | 8.8 | — | 2022-10-26 | |
| CVE-2022-39360 | Metabase SSO users able to circumvent IdP login by doing password reset | * ≥ 0.41.0 < 0.41.9 ≥ 0.42.0 < 0.42.6 | 6.5 | — | 2022-10-26 | |
| CVE-2022-39359 | Metabase's GeoJSON validation doesn't prevent redirects to blocked URLs | * ≥ 0.41.0 < 0.41.9 ≥ 0.42.0 < 0.42.6 | 6.5 | — | 2022-10-26 | |
| CVE-2022-39358 | Metabase vulnerable to circumvention of Locked parameter in Signed Embedding | * ≥ 0.42.0 < 0.42.6 ≥ 0.43.0 < 0.43.7 | 6.5 | — | 2022-10-26 | |
| CVE-2022-43776 | The url parameter of the /api/geojson endpoint in Metabase versions <44.5 can be used to perform Server Side R... | < 0.44.5 | 6.5 | — | 2022-10-26 | |
| CVE-2022-24855 | XSS vulnerability in Metabase | * ≥ 0.40.0 < 0.40.8 ≥ 0.41.0 < 0.41.7 | 5.4 | — | 2022-04-14 | |
| CVE-2022-24854 | Database bypassing any permissions in Metabase via SQlite attach | * ≥ 0.41.0 < 0.41.7 ≥ 0.42.0 < 0.42.4 | 8.8 | — | 2022-04-14 | |
| CVE-2022-24853 | File system exposure in Metabase | * ≥ 0.40.0 < 0.40.8 ≥ 0.41.0 < 0.41.7 | 5.3 | — | 2022-04-14 | |
| CVE-2018-0697 | Cross-site scripting vulnerability in Metabase version 0.29.3 and earlier allows remote attackers to inject ar... | ≤ 0.29.3 | 6.1 | — | 2018-11-15 |
Controla estas versiones en tus propios servidores
InfraGuard recopila las versiones de software instaladas en cada servidor y señala las que tienen vulnerabilidades conocidas. Autoalojado: nada sale de tu red.
Datos: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (consulta EPSS en https://www.first.org/epss), endoflife.date. Lista de software: awesome-selfhosted (CC BY-SA 3.0).