Skip to content
CVE PROGRAM SOURCE RECORD10.0 Critical

CVE-2026-72899

Metabase SQL injection via public card or dashboard

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
cisa-cg

Description

Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Metabase Metabase

Default version status: unknown

  • x.58.0 to < x.58.24affected
  • x.58.24unaffected
  • x.59.0 to < x.59.21affected
  • x.59.21unaffected
  • x.60.0 to < x.60.17affected
  • x.60.17unaffected
  • x.61.0 to < x.61.11affected
  • x.61.11unaffected
  • x.62.0 to < x.62.9affected
  • x.62.9unaffected
  • x.63.0 to < x.63.5affected
  • x.63.5unaffected

References