Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
Metabase is an open-source business intelligence and embedded analytics tool. From 1.54.0 until 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4, a Metabase user with permission to add or edit a database connection can achieve remote code execution on the Metabase server by configuring a Snowflake connection to an attacker-controlled server, because a flaw in the Snowflake JDBC driver can write arbitrary files anywhere on the Metabase host, including replacing one of Metabase's own database driver files that later executes inside the Metabase process. This issue is fixed in versions 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-07-21 | 1 | Patch1 |
| 2026-08-10 | 1 | Active Exploitation1 |
| 2026-08-11 | 1 | Active Exploitation1 |
| 2026-08-13 | 1 | Patch1 |
Metabase の CVE-2026-50148 を追加しました。CVSS 10 ですが、鍵はスコアより「誰がデータベース接続を追加できるか」です。攻撃者のSnowflakeサーバへ接続を張ると、任意ファイル書き込みからドライバ差し替えで実行に至ります。修正版と権限の絞り方を… https://cve.autoarticles.net/cve/CVE-2026-50148
Post summary
The post announces CVE‑2026‑50148 for Metabase, outlines detailed technical exploitation steps, and highlights available fixes and permission restrictions, but does not provide direct PoC or evidence of active exploitation.
❄️ Metabase critical RCE: CVE-2026-50148 allows arbitrary file write via the Snowflake JDBC driver. CVSS 10. Affects versions 1.54.0–1.60.x. Patch to 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, or 1.60.4. #Metabase #infosec https://secalerts.co/vulnerability/CVE-2026-50148?utm_campaign=x https://t.co/xjEXV3jnfR
Post summary
The tweet announces a critical RCE in Metabase (CVE-2026-50148) and lists patch versions to mitigate the arbitrary file write flaw.
Attackers exploited CVE-2026-50148 to gain administrator access through SQL injection in Metabase Cloud, then extracted stored credentials to pivot to connected databases. This multi-stage attack chain demonstrates how application-layer compromises enable lateral movement across database infrastructure. #CloudSecurity :link: Full TRC analysis: https://aviatrix.ai/threat-research-center/metabase-sql-injection-zero-day-2026
Post summary
Attackers leveraged CVE-2026-50148 via SQL injection in Metabase Cloud to gain admin access and pivot through extracted credentials, demonstrating an active, multi‑stage exploit chain.
Attackers exploited CVE-2026-50148 in Metabase's notification API to extract database credentials from crafted email templates. Researchers observed lateral movement to connected systems using the compromised credentials. Runtime segmentation helps contain such post-compromise pivoting across infrastructure. 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/metabase-0-day-vulnerability-2026 #CloudSecurity #ZeroTrust
Post summary
Attackers leveraged CVE-2026-50148 in Metabase’s notification API to harvest database credentials from crafted email templates, enabling lateral movement across connected systems. Runtime segmentation can help contain such post‑compromise pivoting.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | metabase | metabase | - | - | - |