CVE-2026-103928

Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and actions against an H2 data source are passed through without restricting host-facing built-in functions. A user authorized to run native queries or actions can invoke FILE_READ, FILE_WRITE, CSVREAD, CSVWRITE, or LINK_SCHEMA to read or write arbitrary files on the Metabase server or link other databases. The default sample database uses H2, so the vulnerable surface is exposed by default. This issue is fixed in versions 1.58.16, 1.59.13, 1.60.9, and 1.61.4.

• CWE-73

• https://github.com/metabase/metabase/commit/8fb4f0c8a22f195390b4a1d8f5c21db695ae8cc3
• https://github.com/metabase/metabase/commit/a943448e90e23dbb78001ddedbb15e9c0794473c
• https://github.com/metabase/metabase/commit/abf3fb8427eccefd8d46149cdebe38f3b49f964f
• https://github.com/metabase/metabase/commit/ae60d1cd156d097f084af43a536b3ab60510c9a4
• https://github.com/metabase/metabase/commit/e231432adcc813a75f3ca4832818bda2d9d265da
• https://github.com/metabase/metabase/releases/tag/v0.58.15.3
• https://github.com/metabase/metabase/releases/tag/v0.59.12.1
• https://github.com/metabase/metabase/releases/tag/v0.60.8.1
• https://github.com/metabase/metabase/releases/tag/v0.61.3.4
• https://github.com/metabase/metabase/security/advisories/GHSA-cwxq-fmxq-jv8h

Published

Oct 13, 2026

Last Modified

Oct 13, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-103912The JetFormBuilder — Dynamic Blocks Form Builder plugin for …4.7
• CVE-2026-103913The GeoDirectory plugin for WordPress is vulnerable to SQL I…7.5
• CVE-2026-103918oRPC is a tool that helps build APIs that are end-to-end typ…6.5
• CVE-2026-103921GraphQL Tools provides utilities for building, stitching, an…7.4
• CVE-2026-103922Capacitor is a cross-platform native runtime for web applica…9.3
• CVE-2026-103923KaTeX is a fast, easy-to-use JavaScript library for TeX math…2.1
• CVE-2026-103929mise manages dev tools like node, python, cmake, and terrafo…7.8
• CVE-2026-103930cpp-httplib is a C++ header-only HTTP/HTTPS library. From 0.…3.7
• CVE-2026-103936libp2p is a JavaScript implementation of the libp2p networki…7.5
• CVE-2026-103937Misskey is an open source, federated social media platform. …8.7
• CVE-2026-103946An SQL injection vulnerability could allow an authenticated …8.3
• CVE-2026-103956Missing authentication for critical function in the authenti…10