Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Metabase can let authorized users read or write any file

CVE-2026-103928 · published today
Summary

Versions of Metabase from 1.55.0 up to 1.61.4 allow users who can run native queries to use built-in H2 functions to access any file on the server or connect other databases. The risk is present by default because the sample database uses H2. Updating to the latest patched releases removes the dangerous functions.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
metabase metabase >= 1.55.0, < 1.58.16
Original advisory text
Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions
Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and actions against an H2 data source are passed through without restricting host-facing built-in functions. A user authorized to run native queries or actions can invoke FILE_READ, FILE_WRITE, CSVREAD, CSVWRITE, or LINK_SCHEMA to read or write arbitrary files on the Metabase server or link other databases. The default sample database uses H2, so the vulnerable surface is exposed by default. This issue is fixed in versions 1.58.16, 1.59.13, 1.60.9, and 1.61.4.
References
Severity
9.3 Critical
Type
CWE-73External Control of File Name or Path
Timeline
Published13 Oct 2026
Updated13 Oct 2026
First seen13 Oct 2026
Sources
CVE-2026-103928 · NVD
CVE-2026-103928 · MITRE
Track software like this
Free during beta