What is the CVSS score of CVE-2026-50147?

CVE-2026-50147 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Metabase are affected by CVE-2026-50147?

Metabase versions 1.57.0 and later contain an arbitrary file read vulnerability that allows users with database configuration privileges to exfiltrate sensitive files from the application server.. A patch is available.

How to fix or mitigate CVE-2026-50147?

Within 24 hours: verify which versions of Metabase are deployed and immediately audit who holds database configuration privileges, implementing least-privilege access controls to restrict these permissions to only absolutely essential personnel. Within 7 days: enable comprehensive audit logging for all JDBC connection parameters and database configuration modifications, and conduct a historical review of configuration changes and database administrator account activity for suspicious patterns. Within 30 days: subscribe to Metabase security advisories and establish a testing schedule for patched versions; evaluate architectural mitigations such as running Metabase with restrictive filesystem permissions, containerization with security policies, or network isolation to reduce blast radius until a patch is available.

Metabase CVE-2026-50147

EUVD-2026-44702 HIGH

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)

2026-07-15 GitHub_M

Information Disclosure Metabase

7.6

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.6 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jul 15, 2026 - 17:48 EUVD

Analysis Generated

Jul 15, 2026 - 16:17 vuln.today

CVE Published

Jul 15, 2026 - 15:21 cve.org

HIGH 7.6

DescriptionCVE.org

Metabase is an open-source business intelligence and embedded analytics tool. From 1.57.0 until 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4, an attacker who can configure a Metabase database connection can read arbitrary files from the Metabase server's filesystem by adding unsafe JDBC parameters to a MySQL or MariaDB connection, causing the driver to read files from the Metabase host and expose the contents through queries against the connected database or through validation error messages. This issue is fixed in versions 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4.

AnalysisAI

Arbitrary file read in Metabase (versions from 1.57.0 up to the fixed releases) allows an attacker who already holds database-configuration privileges to exfiltrate files from the Metabase server's host filesystem by injecting unsafe JDBC parameters into a MySQL or MariaDB connection. The malicious driver options coerce the JDBC client to read local host files and surface their contents through query results or connection-validation error messages. No public exploit identified at time of analysis; the flaw affects self-hosted and embedded deployments of this open-source BI platform.