« Volver al listado

CVE-2026-50147

Estado: AnalizadaAlta (7.6)—

Metabase is an open-source business intelligence and embedded analytics tool. From 1.57.0 until 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4, an attacker who can configure a Metabase database connection can read arbitrary files from the Metabase server's filesystem by adding unsafe JDBC parameters to a MySQL or MariaDB connection, causing the driver to read files from the Metabase host and expose the contents through queries against the connected database or through validation error messages. This issue is fixed in versions 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vector AV:N/PR:H sin UI:R indica acceso remoto con privilegios elevados (admin de BD). Configuración maliciosa de conexión JDBC en MySQL/MariaDB para lectura de archivos arbitrarios del servidor.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability ScanningUser TrainingThreat Intelligence ProgramRestrict File and Directory PermissionsPrivileged Account ManagementPassword Policies

Tecnologías afectadas (1)

Metabase — Metabase

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-50147",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-50147",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-07-15T16:03:56.744985Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.6,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "metabase",
          "product": "metabase",
          "versions": [
            {
              "status": "affected",
              "version": ">= 1.57.0, < 1.57.19.1"
            },
            {
              "status": "affected",
              "version": ">= 1.58.0, < 1.58.14.1"
            },
            {
              "status": "affected",
              "version": ">= 1.59.0, < 1.59.10"
            },
            {
              "status": "affected",
              "version": ">= 1.60.0, < 1.60.4"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-07-15T16:16:47.830",
  "references": [
    {
      "url": "https://github.com/metabase/metabase/security/advisories/GHSA-mfpj-crjq-xrcp",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-88"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Metabase is an open-source business intelligence and embedded analytics tool. From 1.57.0 until 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4, an attacker who can configure a Metabase database connection can read arbitrary files from the Metabase server's filesystem by adding unsafe JDBC parameters to a MySQL or MariaDB connection, causing the driver to read files from the Metabase host and expose the contents through queries against the connected database or through validation error messages. This issue is fixed in versions 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4."
    }
  ],
  "lastModified": "2026-07-30T14:30:23.497",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "195CA520-884A-4A51-A8CB-89BCF48BC2DA",
              "versionEndExcluding": "1.57.19.1",
              "versionStartIncluding": "1.57.0"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4760DEF5-0889-48DA-8830-10C52005F3DC",
              "versionEndExcluding": "1.58.14.1",
              "versionStartIncluding": "1.58.0"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3AF89DE1-494D-4340-AA23-09DE4ECEA259",
              "versionEndExcluding": "1.59.10",
              "versionStartIncluding": "1.59.0"
            },
            {
              "criteria": "cpe:2.3:a:metabase:metabase:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "74A38166-DDDF-4EC7-A716-53947895C9F5",
              "versionEndExcluding": "1.60.4",
              "versionStartIncluding": "1.60.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}