Data Analytics Platform Vulnerability in Metabase by Metabase
CVE-2026-22805

2.1LOW

Key Information:

Vendor

Metabase

Status
Metabase
Vendor
CVE Published:
12 January 2026

What is CVE-2026-22805?

Metabase, an open-source data analytics platform, has a vulnerability that impacts self-hosted instances allowing user-created subscriptions before versions 55.13, 56.3, and 57.1. If these instances are colocated with other unsecured resources, they may be at risk of unauthorized access. Users are urged to update to the latest versions to mitigate potential threats.

Affected Version(s)

metabase >= 0.57.0-beta, < 57.1 < 0.57.0-beta, 57.1

metabase >= 0.56.0-beta, < 56.3 < 0.56.0-beta, 56.3

metabase < 55.13 < 55.13

References

https://github.com/metabase/metabase/security/advisories/...
x_refsource_CONFIRM

CVSS V4

Score:
2.1
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.