Executive brief
Metabase is an open-source business intelligence and data visualization tool used by organizations to create dashboards and reports. An unauthenticated attacker can bypass existing security controls that block requests to internal services by crafting a malicious GeoJSON URL using the 0.0.0.0 address. This allows the attacker to retrieve sensitive data from services running on the Metabase server itself (such as local databases or APIs) without proper authentication.
Technical details
This vulnerability is a Server-Side Request Forgery (SSRF) bypass affecting the GeoJSON feature. The root cause is incomplete validation of the 0.0.0.0 wildcard address in the DNS resolver and host validation functions. While previous fixes added checks for link-local, loopback, and site-local addresses, Java's InetAddress.getByName("0.0.0.0") returns false for all three checks, allowing it to bypass validation. An authenticated admin can save a custom GeoJSON entry with a URL like http://0.0.0.0:9671/secret.json, and any unauthenticated user can trigger a GET /api/geojson/ request that causes the Metabase server to make an outbound connection to the loopback interface and return the response. The fix requires adding an explicit check for isAnyLocalAddress() in the validation logic.
Affected products
- Metabase Metabase through 0.63.18
Timeline
- 2026-06-03: disclosed: Finding 2 reported via email
- 2026-09-16: advisory: CVE-2026-92813 published