CVE-2026-27464: falha de alta gravidade em metabase
Metabase: Server-Side Template Injection via Notifications Endpoint Leads to RCE
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.7epss 0.3%
Metabase is an open-source data analytics platform. In versions prior to 0.57.13 and versions 0.58.x through 0.58.6, authenticated users are able to retrieve sensitive information from a Metabase instance, including database access credentials. During testing, it was confirmed that a low-privileged user can extract sensitive information including database credentials, into the email body via template evaluation. This issue has been fixed in versions 0.57.13 and 0.58.7. To workaround this issue, users can disable notifications in their Metabase instance to disallow access to the vulnerable endpoints.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Produtos afetados
metabase · metabaseCVEs relacionadas — metabase
No mesmo produto, das mais perigosas para as menos.
CVE-2021-41277CRITICALGeoJSON URL validation can expose server files and environment variables to unauthorized usersEPSS 97.2%KEVCVE-2026-59827CRITICALMetabase: Unsafe Deserialization of H2 Query ResultsEPSS 3.8%CVE-2022-24853MEDIUMFile system exposure in MetabaseEPSS 2.5%CVE-2023-37470CRITICALMetabase vulnerable to remote code execution via POST /api/setup/validate API endpoint EPSS 1.3%CVE-2022-39361HIGHMetabase vulnerable to Remote Code Execution via H2EPSS 1.3%CVE-2022-24854HIGHDatabase bypassing any permissions in Metabase via SQlite attachEPSS 1.1%