en
Metabase is a software provider focused on business intelligence and embedded analytics. Its platform helps internal teams and software providers query connected data, build visualizations and dashboards, share reporting, and deliver customer-facing analytics. Metabase supports open-source self-hosting, commercial editions, and a managed cloud service.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
As of 10/22/2026, metabase recorded 6 security vulnerabilities in the last 90 days across 1 products, including 5 rated High or above and 1 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, metabase had the most security vulnerabilities in the metabase ecosystem, with 6 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
CVE-2026-103928Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in FunctionsCVE-2026-92813Metabase through 0.63.18 SSRF via GeoJSON URL validation bypassCVE-2026-86116Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management APICVE-2026-72900Metabase information exposureCVE-2026-72899Metabase SQL injection via public card or dashboard34 Results | Page 1 of 4
| SeverityMedium |
| SeverityHigh |
| SeverityCritical |
| SeverityCritical |
| SeverityHigh |
| SeverityCritical |
| SeverityCritical |
| SeverityCritical |