Executive brief
Metabase is a business intelligence tool used to visualize and analyze data. A vulnerability allows an administrator to read sensitive files directly from the server hosting the Metabase application, such as configuration files or environment variables. This could lead to the exposure of credentials or other internal data, potentially allowing for further compromise of the organization's infrastructure.
Technical details
A vulnerability in Metabase's database connection configuration allows for arbitrary file read via JDBC connection property injection. An attacker with administrative privileges (required to configure database connections) can supply malicious JDBC parameters when setting up a MySQL or MariaDB connection. These parameters cause the underlying driver to read local files from the Metabase host and return their contents through SQL queries or connection validation error messages. This issue stems from improper neutralization of argument delimiters (CWE-88). Patches are available in versions 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4.
Affected products
- Metabase Metabase >= 1.57.0, < 1.57.19.1; >= 1.58.0, < 1.58.14.1; >= 1.59.0, < 1.59.10; >= 1.60.0, < 1.60.4
Timeline
- 2026-05-28: advisory: Original GitHub security advisory published
- 2026-07-15: disclosed: CVE-2026-50147 published to NVD