CVE-2026-50148

CRITICAL 10.0

Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write

CVSS Score

10.0

EPSS Score

0.0%

EPSS Percentile

0th

Metabase is an open-source business intelligence and embedded analytics tool. From 1.54.0 until 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4, a Metabase user with permission to add or edit a database connection can achieve remote code execution on the Metabase server by configuring a Snowflake connection to an attacker-controlled server, because a flaw in the Snowflake JDBC driver can write arbitrary files anywhere on the Metabase host, including replacing one of Metabase's own database driver files that later executes inside the Metabase process. This issue is fixed in versions 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4.

CWE	CWE-73
Vendor	metabase
Product	metabase
Published	Jul 15, 2026

Stay Ahead of the Next One

Get instant alerts for metabase metabase

Be the first to know when new critical vulnerabilities affecting metabase metabase are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

metabase / metabase

>= 1.54.0, < 1.54.24 >= 1.55.0, < 1.55.24 >= 1.56.0, < 1.56.25 >= 1.57.0, < 1.57.19 >= 1.58.0, < 1.58.14 >= 1.59.0, < 1.59.10 >= 1.60.0, < 1.60.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/metabase/metabase/security/advisories/GHSA-r6x2-rchx-q9g9