File Access Vulnerability in Metabase Open Source Analytics Platform
CVE-2026-103928
9.3CRITICAL
What is CVE-2026-103928?
The Metabase analytics platform has a vulnerability that allows users with permissions to execute native queries to leverage built-in functions for unauthorized file access. This flaw affects all versions from 1.55.0 to 1.61.4, enabling actions that can read or write files on the server or link to other databases, due to insufficient restrictions on the H2 data source. This vulnerability poses significant risks as the default installation uses H2, potentially exposing sensitive data. The issue has been remedied in subsequent versions 1.58.16, 1.59.13, 1.60.9, and 1.61.4.
Affected Version(s)
metabase >= 1.55.0, < 1.58.16 < 1.55.0, 1.58.16
metabase >= 1.59.0, < 1.59.13 < 1.59.0, 1.59.13
metabase >= 1.60.0, < 1.60.9 < 1.60.0, 1.60.9