CVE-2026-50147

Awaiting Analysis Awaiting Analysis - Queue

Arbitrary File Read in Metabase via JDBC Parameter Injection

Publication date: 2026-07-15

Last updated on: 2026-07-30

Assigner: GitHub, Inc.

Description

Metabase is an open-source business intelligence and embedded analytics tool. From 1.57.0 until 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4, an attacker who can configure a Metabase database connection can read arbitrary files from the Metabase server's filesystem by adding unsafe JDBC parameters to a MySQL or MariaDB connection, causing the driver to read files from the Metabase host and expose the contents through queries against the connected database or through validation error messages. This issue is fixed in versions 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-30

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-50147

EUVD

EUVD-2026-44702

Affected Vendors & Products

Vendor	Product	Version / Range
metabase	metabase	From 1.57.0 (inc) to 1.57.19.1 (exc)
metabase	metabase	From 1.58.0 (inc) to 1.58.14.1 (exc)
metabase	metabase	From 1.59.0 (inc) to 1.59.10 (exc)
metabase	metabase	From 1.60.0 (inc) to 1.60.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-88	The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

Executive Summary

CVE-2026-50147 is a high-severity vulnerability in Metabase versions 1.57.0 to 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4. It allows an attacker with administrative access to read arbitrary files from the Metabase server's filesystem by injecting unsafe JDBC parameters into a MySQL or MariaDB database connection. The JDBC driver then reads files from the server and exposes them through database queries or validation error messages.

Detection Guidance

Check Metabase version to see if it is affected. Run: curl -s http://<metabase-server>/api/version | grep version. If version is between 1.57.0 and 1.57.19.0, 1.58.1 to 1.58.14.0, or 1.59.0 to 1.59.9, the system is vulnerable.

Impact Analysis

This vulnerability can expose sensitive data such as the Metabase application database, environment variables, and OS configuration. An attacker could retrieve these files through ordinary database queries or error messages during connection validation, potentially leading to data breaches or unauthorized access to critical system information.

Compliance Impact

This vulnerability can lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Exposure of personal or health data could result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade Metabase to a patched version: 1.57.19.1, 1.58.14.1, 1.59.10, or 1.60.4. If immediate upgrade is not possible, restrict administrative access and disable MySQL/MariaDB database connections until patched.

Hi! I’m here to help you understand CVE-2026-50147. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70