Metabase CVE-2026-92813

Requires the target to use Metabase's custom GeoJSON maps feature and, per the CVSS vector (PR:H), administrative/authenticated access to save a custom GeoJSON URL entry - the exploit hinges on the URL validator failing to reject the unspecified address 0.0.0.0, which resolves to loopback and reaches localhost-bound services. Limiting factors: an attacker must be able to persist a malicious GeoJSON entry (admin-gated per vendor scoring) and there must be a valuable service listening on loopback; impact is confidentiality-only (read of responses), with no integrity or availability effect. Note the description's claim that the triggered read reaches 'unauthenticated callers' conflicts with PR:H and, if accurate, removes the authentication barrier for triggering/reading - verify against the vendor advisory.

This is a CWE-918 SSRF in Metabase's custom GeoJSON URL handling, allowing an attacker to bypass address validation with the unspecified address 0.0.0.0 to reach loopback (127.0.0.1) services that are normally unreachable externally. The vendor CVSS 4.0 vector (6.9, AV:N/AC:L/PR:H/VC:H/VI:N/VA:N) treats this as a network, low-complexity, HIGH-privilege, confidentiality-only issue - consistent with the fact that saving a custom GeoJSON map entry is an admin-gated setting in Metabase. HOWEVER there is a NOTABLE CONFLICT: the description states twice that 'unauthenticated attackers' can reach loopback and that responses are returned 'to unauthenticated callers' - this contradicts the PR:H metric. The most likely reconciliation is that persisting the malicious entry requires privilege (PR:H) while the resulting fetch/read can be triggered without authentication; this should be verified with the vendor/advisory. A public POC exists (geo-chen/oss), which raises practical risk, but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of widespread active exploitation - treat this as a real-but-moderate priority: confidentiality-only, no integrity/availability impact, and (per the vendor) requiring high privileges to plant the payload. If the unauthenticated-trigger reading holds true, the effective severity is meaningfully higher than 6.9.

An attacker saves a custom GeoJSON map entry in Metabase pointing at a URL using 0.0.0.0 (which bypasses the URL allowlist validation), then triggers the GeoJSON fetch so Metabase server-side requests a loopback-bound internal service and returns its response to the caller - exposing internal admin panels, cloud metadata, or other localhost-only services. A public proof-of-concept documenting the 0.0.0.0 bypass is available, lowering the effort to reproduce.