CVE-2026-103928

Awaiting Analysis Awaiting Analysis - Queue

Arbitrary File Read/Write via H2 Functions in Metabase

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and actions against an H2 data source are passed through without restricting host-facing built-in functions. A user authorized to run native queries or actions can invoke FILE_READ, FILE_WRITE, CSVREAD, CSVWRITE, or LINK_SCHEMA to read or write arbitrary files on the Metabase server or link other databases. The default sample database uses H2, so the vulnerable surface is exposed by default. This issue is fixed in versions 1.58.16, 1.59.13, 1.60.9, and 1.61.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-103928

EUVD

EUVD-2026-98826

Affected Vendors & Products

Vendor	Product	Version / Range
metabase	metabase	>= 1.55.0, < 1.58.16
metabase	metabase	>= 1.59.0, < 1.59.13
metabase	metabase	>= 1.60.0, < 1.60.9
metabase	metabase	>= 1.61.0, < 1.61.4
metabase	metabase	>= 0.55.0, < 0.58.15.3
metabase	metabase	>= 0.59.0, < 0.59.12.1
metabase	metabase	>= 0.60.0, < 0.60.8.1
metabase	metabase	>= 0.61.0, < 0.61.3.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-73	The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

Executive Summary

This vulnerability affects Metabase versions between 1.55.0 and 1.61.3. It allows users with permission to run native H2 queries or actions to exploit unsafe H2 built-in functions like FILE_READ, FILE_WRITE, CSVREAD, CSVWRITE, and LINK_SCHEMA. These functions can read or write arbitrary files on the Metabase server or link other databases without restriction.

Detection Guidance

To detect this vulnerability, check if your Metabase instance is running a vulnerable version (1.55.0 to 1.61.3). Review query logs for attempts to use H2 functions like FILE_READ, FILE_WRITE, CSVREAD, CSVWRITE, or LINK_SCHEMA. Enable verbose logging in Metabase to capture such queries.

Impact Analysis

An attacker with query access could read sensitive files on the server, write malicious files, or access linked databases. This could lead to data breaches, unauthorized modifications, or further system compromise. The default sample database uses H2, making the issue exposed by default.

Compliance Impact

This vulnerability could violate GDPR and HIPAA by enabling unauthorized access to personal or health data through file reads or database links. Compliance requires preventing such access, so this flaw risks non-compliance with data protection requirements.

Mitigation Strategies

Upgrade Metabase to a patched version (1.58.16, 1.59.13, 1.60.9, or 1.61.4) immediately. If upgrading is not possible, restrict access to native H2 queries and actions for all users. Disable the default sample database if it uses H2.

Hi! I’m here to help you understand CVE-2026-103928. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70