Executive Summary

A critical vulnerability (CVE-2026-50148) with a CVSS score of 10 has been discovered in Metabase, an open-source business intelligence tool. This vulnerability allows a Metabase user with permission to add or edit a database connection to achieve remote code execution on the Metabase server. All users of affected Metabase versions must update to patched versions immediately.

Technical Analysis

This vulnerability exists in Metabase versions from 1.54.0 until 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4. The flaw is caused by a vulnerability in the Snowflake JDBC driver that allows writing arbitrary files anywhere on the Metabase host. A Metabase user with permission to add or edit a database connection can configure a Snowflake connection to an attacker-controlled server, leading to remote code execution on the Metabase server.

How It Gets Exploited

An attacker with permission to add or edit a database connection in Metabase can exploit this vulnerability by configuring a Snowflake connection to an attacker-controlled server. The attacker-controlled server would need to be able to write arbitrary files to the Metabase host, including replacing one of Metabase's own database driver files that later executes inside the Metabase process. This would allow the attacker to achieve remote code execution on the Metabase server.

Impact Assessment

The impact of this vulnerability is critical, with a CVSS score of 10. Successful exploitation allows for remote code execution on the Metabase server, potentially leading to complete control over the server and access to sensitive data. The affected products and versions are:

  • Metabase 1.54.0 to 1.54.24
  • Metabase 1.55.0 to 1.55.24
  • Metabase 1.56.0 to 1.56.25
  • Metabase 1.57.0 to 1.57.19
  • Metabase 1.58.0 to 1.58.14
  • Metabase 1.59.0 to 1.59.10
  • Metabase 1.60.0 to 1.60.4

Recommended Actions

To mitigate this vulnerability, users of affected Metabase versions must update to patched versions:

  • Update Metabase to version 1.54.24 or later
  • Update Metabase to version 1.55.24 or later
  • Update Metabase to version 1.56.25 or later
  • Update Metabase to version 1.57.19 or later
  • Update Metabase to version 1.58.14 or later
  • Update Metabase to version 1.59.10 or later
  • Update Metabase to version 1.60.4 or later

Additionally, restrict permissions to add or edit database connections to trusted users only.

Sources

  • National Vulnerability Database (NVD)