PT-2026-21369 · Metabase · Metabase

Sho Odagiri · Published 2026-02-21 · Updated 2026-02-21 · CVE-2026-27464

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Metabase versions prior to 0.57.13 Metabase versions 0.58.x through 0.58.6

Description Metabase is a data analytics platform where authenticated users could retrieve sensitive information, including database access credentials. A low-privileged user can extract sensitive information, such as database credentials, and include it in the email body through template evaluation. The issue involves access to vulnerable endpoints.

Recommendations Disable notifications in your Metabase instance to disallow access to the vulnerable endpoints. Update to version 0.57.13 or later. Update to version 0.58.7 or later.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

CWE-1336

Related Identifiers

CVE-2026-27464

GHSA-VCJ8-RCM8-GFJ9

Affected Products

Metabase

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27464.json · Exploit
• https://github.com/metabase/metabase/security/advisories/GHSA-vcj8-rcm8-gfj9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-27464 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27464 · Vendor Advisory
• https://github.com/metabase/metabase/releases/tag/v0.58.7 · Note
• https://github.com/metabase/metabase/releases/tag/v0.57.13 · Note
• https://t.me/CVEtracker/45362 · Telegram Post
• https://twitter.com/CVEnew/status/2025154170924261454 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2025198535906410578 · Twitter Post
• https://t.me/cveNotify/152706 · Telegram Post