Vulnerability Details CVE-2026-50147
Metabase is an open-source business intelligence and embedded analytics tool. From 1.57.0 until 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4, an attacker who can configure a Metabase database connection can read arbitrary files from the Metabase server's filesystem by adding unsafe JDBC parameters to a MySQL or MariaDB connection, causing the driver to read files from the Metabase host and expose the contents through queries against the connected database or through validation error messages. This issue is fixed in versions 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 10.0%
CVSS Severity
CVSS v3 Score 7.6
Products affected by CVE-2026-50147
-
cpe:2.3:a:metabase:metabase:1.57.0
-
cpe:2.3:a:metabase:metabase:1.57.1
-
cpe:2.3:a:metabase:metabase:1.57.1.1
-
cpe:2.3:a:metabase:metabase:1.57.10
-
cpe:2.3:a:metabase:metabase:1.57.10.1
-
cpe:2.3:a:metabase:metabase:1.57.10.2
-
cpe:2.3:a:metabase:metabase:1.57.10.3
-
cpe:2.3:a:metabase:metabase:1.57.10.4
-
cpe:2.3:a:metabase:metabase:1.57.10.5
-
cpe:2.3:a:metabase:metabase:1.57.10.6
-
cpe:2.3:a:metabase:metabase:1.57.10.7
-
cpe:2.3:a:metabase:metabase:1.57.11
-
cpe:2.3:a:metabase:metabase:1.57.11.1
-
cpe:2.3:a:metabase:metabase:1.57.12
-
cpe:2.3:a:metabase:metabase:1.57.13
-
cpe:2.3:a:metabase:metabase:1.57.14
-
cpe:2.3:a:metabase:metabase:1.57.15
-
cpe:2.3:a:metabase:metabase:1.57.16
-
cpe:2.3:a:metabase:metabase:1.57.17
-
cpe:2.3:a:metabase:metabase:1.57.18
-
cpe:2.3:a:metabase:metabase:1.57.19
-
cpe:2.3:a:metabase:metabase:1.57.2
-
cpe:2.3:a:metabase:metabase:1.57.2.1
-
cpe:2.3:a:metabase:metabase:1.57.2.2
-
cpe:2.3:a:metabase:metabase:1.57.2.3
-
cpe:2.3:a:metabase:metabase:1.57.2.4
-
cpe:2.3:a:metabase:metabase:1.57.2.5
-
cpe:2.3:a:metabase:metabase:1.57.2.6
-
cpe:2.3:a:metabase:metabase:1.57.2.7
-
cpe:2.3:a:metabase:metabase:1.57.3
-
cpe:2.3:a:metabase:metabase:1.57.3.1
-
cpe:2.3:a:metabase:metabase:1.57.3.2
-
cpe:2.3:a:metabase:metabase:1.57.3.3
-
cpe:2.3:a:metabase:metabase:1.57.4
-
cpe:2.3:a:metabase:metabase:1.57.4.1
-
cpe:2.3:a:metabase:metabase:1.57.4.2
-
cpe:2.3:a:metabase:metabase:1.57.4.3
-
cpe:2.3:a:metabase:metabase:1.57.4.4
-
cpe:2.3:a:metabase:metabase:1.57.5
-
cpe:2.3:a:metabase:metabase:1.57.5.1
-
cpe:2.3:a:metabase:metabase:1.57.5.2
-
cpe:2.3:a:metabase:metabase:1.57.5.3
-
cpe:2.3:a:metabase:metabase:1.57.5.4
-
cpe:2.3:a:metabase:metabase:1.57.5.5
-
cpe:2.3:a:metabase:metabase:1.57.5.6
-
cpe:2.3:a:metabase:metabase:1.57.5.7
-
cpe:2.3:a:metabase:metabase:1.57.5.8
-
cpe:2.3:a:metabase:metabase:1.57.5.9
-
cpe:2.3:a:metabase:metabase:1.57.6
-
cpe:2.3:a:metabase:metabase:1.57.6.1
-
cpe:2.3:a:metabase:metabase:1.57.6.2
-
cpe:2.3:a:metabase:metabase:1.57.6.3
-
cpe:2.3:a:metabase:metabase:1.57.7
-
cpe:2.3:a:metabase:metabase:1.57.7.1
-
cpe:2.3:a:metabase:metabase:1.57.7.10
-
cpe:2.3:a:metabase:metabase:1.57.7.11
-
cpe:2.3:a:metabase:metabase:1.57.7.12
-
cpe:2.3:a:metabase:metabase:1.57.7.13
-
cpe:2.3:a:metabase:metabase:1.57.7.14
-
cpe:2.3:a:metabase:metabase:1.57.7.15
-
cpe:2.3:a:metabase:metabase:1.57.7.16
-
cpe:2.3:a:metabase:metabase:1.57.7.2
-
cpe:2.3:a:metabase:metabase:1.57.7.3
-
cpe:2.3:a:metabase:metabase:1.57.7.4
-
cpe:2.3:a:metabase:metabase:1.57.7.5
-
cpe:2.3:a:metabase:metabase:1.57.7.6
-
cpe:2.3:a:metabase:metabase:1.57.7.7
-
cpe:2.3:a:metabase:metabase:1.57.7.8
-
cpe:2.3:a:metabase:metabase:1.57.7.9
-
cpe:2.3:a:metabase:metabase:1.57.8
-
cpe:2.3:a:metabase:metabase:1.57.8.1
-
cpe:2.3:a:metabase:metabase:1.57.8.2
-
cpe:2.3:a:metabase:metabase:1.57.9
-
cpe:2.3:a:metabase:metabase:1.57.9.1
-
cpe:2.3:a:metabase:metabase:1.57.9.2
-
cpe:2.3:a:metabase:metabase:1.57.9.3
-
cpe:2.3:a:metabase:metabase:1.57.9.4
-
cpe:2.3:a:metabase:metabase:1.58.0
-
cpe:2.3:a:metabase:metabase:1.58.0.1
-
cpe:2.3:a:metabase:metabase:1.58.0.10
-
cpe:2.3:a:metabase:metabase:1.58.0.2
-
cpe:2.3:a:metabase:metabase:1.58.0.3
-
cpe:2.3:a:metabase:metabase:1.58.0.4
-
cpe:2.3:a:metabase:metabase:1.58.0.5
-
cpe:2.3:a:metabase:metabase:1.58.0.6
-
cpe:2.3:a:metabase:metabase:1.58.0.7
-
cpe:2.3:a:metabase:metabase:1.58.0.8
-
cpe:2.3:a:metabase:metabase:1.58.0.9
-
cpe:2.3:a:metabase:metabase:1.58.1
-
cpe:2.3:a:metabase:metabase:1.58.1.1
-
cpe:2.3:a:metabase:metabase:1.58.1.2
-
cpe:2.3:a:metabase:metabase:1.58.1.3
-
cpe:2.3:a:metabase:metabase:1.58.10
-
cpe:2.3:a:metabase:metabase:1.58.10.1
-
cpe:2.3:a:metabase:metabase:1.58.11
-
cpe:2.3:a:metabase:metabase:1.58.12
-
cpe:2.3:a:metabase:metabase:1.58.13
-
cpe:2.3:a:metabase:metabase:1.58.13.1
-
cpe:2.3:a:metabase:metabase:1.58.14
-
cpe:2.3:a:metabase:metabase:1.58.2
-
cpe:2.3:a:metabase:metabase:1.58.2.1
-
cpe:2.3:a:metabase:metabase:1.58.2.2
-
cpe:2.3:a:metabase:metabase:1.58.2.3
-
cpe:2.3:a:metabase:metabase:1.58.2.4
-
cpe:2.3:a:metabase:metabase:1.58.2.5
-
cpe:2.3:a:metabase:metabase:1.58.2.6
-
cpe:2.3:a:metabase:metabase:1.58.3
-
cpe:2.3:a:metabase:metabase:1.58.3.1
-
cpe:2.3:a:metabase:metabase:1.58.3.2
-
cpe:2.3:a:metabase:metabase:1.58.3.3
-
cpe:2.3:a:metabase:metabase:1.58.3.4
-
cpe:2.3:a:metabase:metabase:1.58.4
-
cpe:2.3:a:metabase:metabase:1.58.4.1
-
cpe:2.3:a:metabase:metabase:1.58.4.2
-
cpe:2.3:a:metabase:metabase:1.58.5
-
cpe:2.3:a:metabase:metabase:1.58.5.1
-
cpe:2.3:a:metabase:metabase:1.58.5.2
-
cpe:2.3:a:metabase:metabase:1.58.5.3
-
cpe:2.3:a:metabase:metabase:1.58.5.4
-
cpe:2.3:a:metabase:metabase:1.58.5.5
-
cpe:2.3:a:metabase:metabase:1.58.6
-
cpe:2.3:a:metabase:metabase:1.58.6.1
-
cpe:2.3:a:metabase:metabase:1.58.7
-
cpe:2.3:a:metabase:metabase:1.58.7.1
-
cpe:2.3:a:metabase:metabase:1.58.7.2
-
cpe:2.3:a:metabase:metabase:1.58.7.3
-
cpe:2.3:a:metabase:metabase:1.58.7.4
-
cpe:2.3:a:metabase:metabase:1.58.7.5
-
cpe:2.3:a:metabase:metabase:1.58.7.6
-
cpe:2.3:a:metabase:metabase:1.58.8
-
cpe:2.3:a:metabase:metabase:1.58.8.1
-
cpe:2.3:a:metabase:metabase:1.58.8.2
-
cpe:2.3:a:metabase:metabase:1.58.8.3
-
cpe:2.3:a:metabase:metabase:1.58.8.4
-
cpe:2.3:a:metabase:metabase:1.58.8.5
-
cpe:2.3:a:metabase:metabase:1.58.8.6
-
cpe:2.3:a:metabase:metabase:1.58.9
-
cpe:2.3:a:metabase:metabase:1.58.9.1
-
cpe:2.3:a:metabase:metabase:1.58.9.2
-
cpe:2.3:a:metabase:metabase:1.59.0
-
cpe:2.3:a:metabase:metabase:1.59.0.1
-
cpe:2.3:a:metabase:metabase:1.59.0.2
-
cpe:2.3:a:metabase:metabase:1.59.0.3
-
cpe:2.3:a:metabase:metabase:1.59.0.4
-
cpe:2.3:a:metabase:metabase:1.59.0.5
-
cpe:2.3:a:metabase:metabase:1.59.0.6
-
cpe:2.3:a:metabase:metabase:1.59.0.7
-
cpe:2.3:a:metabase:metabase:1.59.1
-
cpe:2.3:a:metabase:metabase:1.59.1.1
-
cpe:2.3:a:metabase:metabase:1.59.1.2
-
cpe:2.3:a:metabase:metabase:1.59.1.3
-
cpe:2.3:a:metabase:metabase:1.59.1.4
-
cpe:2.3:a:metabase:metabase:1.59.1.5
-
cpe:2.3:a:metabase:metabase:1.59.1.6
-
cpe:2.3:a:metabase:metabase:1.59.2
-
cpe:2.3:a:metabase:metabase:1.59.2.1
-
cpe:2.3:a:metabase:metabase:1.59.2.2
-
cpe:2.3:a:metabase:metabase:1.59.2.3
-
cpe:2.3:a:metabase:metabase:1.59.2.4
-
cpe:2.3:a:metabase:metabase:1.59.2.5
-
cpe:2.3:a:metabase:metabase:1.59.2.6
-
cpe:2.3:a:metabase:metabase:1.59.2.7
-
cpe:2.3:a:metabase:metabase:1.59.3
-
cpe:2.3:a:metabase:metabase:1.59.3.1
-
cpe:2.3:a:metabase:metabase:1.59.3.2
-
cpe:2.3:a:metabase:metabase:1.59.4
-
cpe:2.3:a:metabase:metabase:1.59.4.1
-
cpe:2.3:a:metabase:metabase:1.59.4.2
-
cpe:2.3:a:metabase:metabase:1.59.4.3
-
cpe:2.3:a:metabase:metabase:1.59.4.4
-
cpe:2.3:a:metabase:metabase:1.59.4.5
-
cpe:2.3:a:metabase:metabase:1.59.5
-
cpe:2.3:a:metabase:metabase:1.59.5.1
-
cpe:2.3:a:metabase:metabase:1.59.5.2
-
cpe:2.3:a:metabase:metabase:1.59.6
-
cpe:2.3:a:metabase:metabase:1.59.6.1
-
cpe:2.3:a:metabase:metabase:1.59.6.2
-
cpe:2.3:a:metabase:metabase:1.59.6.3
-
cpe:2.3:a:metabase:metabase:1.59.6.4
-
cpe:2.3:a:metabase:metabase:1.59.6.5
-
cpe:2.3:a:metabase:metabase:1.59.7
-
cpe:2.3:a:metabase:metabase:1.59.7.1
-
cpe:2.3:a:metabase:metabase:1.59.7.2
-
cpe:2.3:a:metabase:metabase:1.59.7.3
-
cpe:2.3:a:metabase:metabase:1.59.8
-
cpe:2.3:a:metabase:metabase:1.59.8.1
-
cpe:2.3:a:metabase:metabase:1.59.8.2
-
cpe:2.3:a:metabase:metabase:1.59.8.3
-
cpe:2.3:a:metabase:metabase:1.59.8.4
-
cpe:2.3:a:metabase:metabase:1.59.8.5
-
cpe:2.3:a:metabase:metabase:1.59.9
-
cpe:2.3:a:metabase:metabase:1.59.9.1
-
cpe:2.3:a:metabase:metabase:1.60.0
-
cpe:2.3:a:metabase:metabase:1.60.0.1
-
cpe:2.3:a:metabase:metabase:1.60.0.2
-
cpe:2.3:a:metabase:metabase:1.60.0.3
-
cpe:2.3:a:metabase:metabase:1.60.0.4
-
cpe:2.3:a:metabase:metabase:1.60.0.5
-
cpe:2.3:a:metabase:metabase:1.60.0.6
-
cpe:2.3:a:metabase:metabase:1.60.0.7
-
cpe:2.3:a:metabase:metabase:1.60.0.8
-
cpe:2.3:a:metabase:metabase:1.60.1
-
cpe:2.3:a:metabase:metabase:1.60.1.1
-
cpe:2.3:a:metabase:metabase:1.60.1.2
-
cpe:2.3:a:metabase:metabase:1.60.1.3
-
cpe:2.3:a:metabase:metabase:1.60.1.4
-
cpe:2.3:a:metabase:metabase:1.60.1.5
-
cpe:2.3:a:metabase:metabase:1.60.1.6
-
cpe:2.3:a:metabase:metabase:1.60.2
-
cpe:2.3:a:metabase:metabase:1.60.2.1
-
cpe:2.3:a:metabase:metabase:1.60.2.2
-
cpe:2.3:a:metabase:metabase:1.60.2.3
-
cpe:2.3:a:metabase:metabase:1.60.2.4
-
cpe:2.3:a:metabase:metabase:1.60.2.5
-
cpe:2.3:a:metabase:metabase:1.60.2.6
-
cpe:2.3:a:metabase:metabase:1.60.3
-
cpe:2.3:a:metabase:metabase:1.60.3.1
-
cpe:2.3:a:metabase:metabase:1.60.3.2
-
cpe:2.3:a:metabase:metabase:1.60.3.3
-
cpe:2.3:a:metabase:metabase:1.60.3.4
-
cpe:2.3:a:metabase:metabase:1.60.3.5
-
cpe:2.3:a:metabase:metabase:1.60.3.6
-
cpe:2.3:a:metabase:metabase:1.60.3.7
-
cpe:2.3:a:metabase:metabase:1.60.3.8