CVE-2026-50148
Metabase, an open‑source business intelligence tool, had a flaw that let a user with database‑connection permissions run arbitrary code on the server. By configuring a Snowflake connection to a malicious server, the attacker could write files anywhere on the host, including Metabase’s own driver files. The issue is fixed in Metabase versions 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Metabase versions 1.54.0 through 1.60.4 (inclusive). Users who can add or edit database connections are at risk.
Real-world impact
An attacker could execute any code on the Metabase server, potentially taking full control of the machine, exfiltrating data, or installing malware.
Why this severity
The CVSS score of 10 reflects that the vulnerability is exploitable over the network, requires no user interaction, and gives an attacker full control over the system. The vector shows low attack complexity, no privileges needed, and complete compromise of confidentiality, integrity, and availability.
What to do about it
- 011. Check the current Metabase version you are running.
- 022. Upgrade to at least version 1.54.24 (or any later release such as 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, or 1.60.4).
- 033. Restart the Metabase service to apply the update.
NVD-referenced vendor advisory
Timeline
- Jul 15, 2026 · 18d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 20, 2026 · 13d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
- Jul 30, 2026 · 3d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- github.com/metabase/metabase/security/…vendor advisory