PT-2026-21369 · Metabase · Metabase

Sho Odagiri · Publicado 2026-02-21 · Atualizado 2026-02-21 · CVE-2026-27464

Positive Technologies (AI Summary)

CVSS v3.1

7.7

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Metabase versions prior to 0.57.13 Metabase versions 0.58.x through 0.58.6

Description Metabase is a data analytics platform where authenticated users could retrieve sensitive information, including database access credentials. A low-privileged user can extract sensitive information, such as database credentials, and include it in the email body through template evaluation. The issue involves access to vulnerable endpoints.

Recommendations Disable notifications in your Metabase instance to disallow access to the vulnerable endpoints. Update to version 0.57.13 or later. Update to version 0.58.7 or later.

Exploit

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

CWE-1336

Identificadores relacionados

CVE-2026-27464

GHSA-VCJ8-RCM8-GFJ9

Produtos afetados

Metabase

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27464.json · Exploit
• https://github.com/metabase/metabase/releases/tag/v0.58.7 · Nota
• https://github.com/metabase/metabase/releases/tag/v0.57.13 · Nota
• https://github.com/metabase/metabase/security/advisories/GHSA-vcj8-rcm8-gfj9 · Correção
• https://t.me/CVEtracker/45362 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2025154170924261454 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2025198535906410578 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-27464 · Nota de Segurança
• https://t.me/cveNotify/152706 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-27464 · Aviso do Fabricante