Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Metabase is an open-source data analytics platform. In versions prior to 0.57.13 and versions 0.58.x through 0.58.6, authenticated users are able to retrieve sensitive information from a Metabase instance, including database access credentials. During testing, it was confirmed that a low-privileged user can extract sensitive information including database credentials, into the email body via template evaluation. This issue has been fixed in versions 0.57.13 and 0.58.7. To workaround this issue, users can disable notifications in their Metabase instance to disallow access to the vulnerable endpoints.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
⚠️ Vulnerabilidad en productos Metabase ❗ CVE-2026-27464 ➡️ Más info: https://www.cert.gov.py/vulnerabilidad-en-productos-metabase/ https://t.co/edCz79sAfM
Post summary
A new vulnerability (CVE-2026-27464) affecting Metabase products has been announced, with a link provided for further information.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | metabase | metabase | - | - | - |
| App | metabase | metabase | - | - | - |