EUVD-2026-81071
GHSA-vhcq-xc7j-xfj8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Aligns with vendor PR:H (saving a custom GeoJSON entry is admin-gated) and confidentiality-only loopback read; if the description's unauthenticated-trigger claim holds, PR drops to N and severity rises.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing unauthenticated attackers to reach loopback services. Attackers can save a malicious GeoJSON entry with 0.0.0.0 and trigger requests that return loopback service responses to unauthenticated callers.
AnalysisAI
Server-side request forgery in Metabase through 0.63.18 lets an attacker bypass GeoJSON URL validation by saving a custom GeoJSON entry that points at the unspecified address 0.0.0.0, which resolves to loopback and causes the Metabase server to fetch from services bound to localhost and return their responses to the caller. Note a conflict in the source data: vendor scoring (CVSS 4.0 with PR:H) requires high-privileged, authenticated access to persist the malicious GeoJSON entry, while the CVE description asserts that the triggered read is returned to unauthenticated callers - the authentication bar for triggering and reading should be verified against the vendor advisory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the target to use Metabase's custom GeoJSON maps feature and, per the CVSS vector (PR:H), administrative/authenticated access to save a custom GeoJSON URL entry - the exploit hinges on the URL validator failing to reject the unspecified address 0.0.0.0, which resolves to loopback and reaches localhost-bound services. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a CWE-918 SSRF in Metabase's custom GeoJSON URL handling, allowing an attacker to bypass address validation with the unspecified address 0.0.0.0 to reach loopback (127.0.0.1) services that are normally unreachable externally. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch was identified in the available data, so the exact fixed version cannot be confirmed; check the Metabase release notes, the project repository at https://github.com/metabase/metabase, and the VulnCheck advisory at https://www.vulncheck.com/advisories/metabase-through-0.63.18-ssrf-via-geojson-url-validation-bypass for an updated build and upgrade to that release as soon as it is published (instances at or below 0.63.18 are affected). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
SQL injection in Metabase's '/reset_password' database endpoint lets a remote, unauthenticated attacker inject arbitrary
Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary comman
Metabase is an open source data analytics platform. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
The url parameter of the /api/geojson endpoint in Metabase versions <44.5 can be used to perform Server Side Request For
SQL injection in Metabase lets an unauthenticated remote attacker execute arbitrary SQL against the connected database b
Metabase is an open-source business intelligence and analytics platform. Rated critical severity (CVSS 9.8), this vulner
Metabase is an open source business analytics engine. Rated critical severity (CVSS 9.6), this vulnerability is remotely
Metabase is an open source business intelligence and analytics application. Rated medium severity (CVSS 5.3), this vulne
Remote code execution in Metabase (open-source business intelligence platform) versions 1.54.0 through the fixed release
Remote code execution in Metabase (open-source BI/analytics platform) versions 1.55.0 through the fixed releases arises
Remote code execution in Metabase's H2 database driver allows an authenticated user with native-query privileges to run
Metabase is data visualization software. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today